Analysis

  • max time kernel
    119s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    31-10-2024 08:26

General

  • Target

    18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe

  • Size

    468KB

  • MD5

    80caa4f196097eb8f465cf9db1f4ece0

  • SHA1

    7010dbcc9cfd652ff3b918ca4f7dc3fcda3e92d0

  • SHA256

    18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6

  • SHA512

    b4d969ada273f653f3815413470dedc6191d1b4ad1c2c9be13297125899bf982694d3fe46af1e9d71a15aa041caa3ca93f4322b7edb03548c35dcbf581c1e0dd

  • SSDEEP

    3072:C1TyogLtaO8Xn+/rPz5FapGKfDzWs8JgmHeAVpyG2w32acNWJle:C1uoN/XngP1Fap8lQ3G2OxcNW

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe
    "C:\Users\Admin\AppData\Local\Temp\18614b8af53f070dbd28802c3c9baf6a590315184af3676bcc39260999a14ae6N.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1132
    • C:\Users\Admin\AppData\Local\Temp\Unicorn-3866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3866.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2940
      • C:\Users\Admin\AppData\Local\Temp\Unicorn-18470.exe
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18470.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2780
        • C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe
          C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2676
          • C:\Users\Admin\AppData\Local\Temp\Unicorn-8220.exe
            C:\Users\Admin\AppData\Local\Temp\Unicorn-8220.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:1740
            • C:\Users\Admin\AppData\Local\Temp\Unicorn-47152.exe
              C:\Users\Admin\AppData\Local\Temp\Unicorn-47152.exe
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1076
              • C:\Users\Admin\AppData\Local\Temp\Unicorn-10751.exe
                C:\Users\Admin\AppData\Local\Temp\Unicorn-10751.exe
                7⤵
                  PID:2800
                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe
                    C:\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe
                    8⤵
                      PID:936
                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-54080.exe
                      C:\Users\Admin\AppData\Local\Temp\Unicorn-54080.exe
                      8⤵
                        PID:3568
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-35566.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-35566.exe
                        8⤵
                          PID:3292
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-51495.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-51495.exe
                          8⤵
                            PID:4296
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
                            8⤵
                              PID:4304
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
                            7⤵
                              PID:1580
                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
                              C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
                              7⤵
                                PID:3388
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
                                7⤵
                                  PID:3176
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
                                  7⤵
                                    PID:4800
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
                                    7⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:4996
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-30823.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-30823.exe
                                  6⤵
                                    PID:2856
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-11601.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-11601.exe
                                    6⤵
                                      PID:2704
                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
                                      6⤵
                                        PID:3824
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
                                        6⤵
                                          PID:3648
                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
                                          6⤵
                                            PID:4256
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-34653.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-34653.exe
                                            6⤵
                                              PID:4536
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-1717.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-1717.exe
                                            5⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2212
                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-35427.exe
                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-35427.exe
                                              6⤵
                                                PID:1252
                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-35468.exe
                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-35468.exe
                                                6⤵
                                                  PID:2700
                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
                                                  6⤵
                                                    PID:3952
                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-33937.exe
                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-33937.exe
                                                    6⤵
                                                      PID:3644
                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-61671.exe
                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-61671.exe
                                                      6⤵
                                                        PID:4968
                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
                                                        6⤵
                                                          PID:4872
                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-53527.exe
                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-53527.exe
                                                        5⤵
                                                          PID:296
                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-64462.exe
                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-64462.exe
                                                            6⤵
                                                              PID:2744
                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
                                                              6⤵
                                                                PID:3252
                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
                                                                6⤵
                                                                  PID:1388
                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
                                                                  6⤵
                                                                    PID:4724
                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
                                                                    6⤵
                                                                      PID:4816
                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe
                                                                    5⤵
                                                                      PID:2844
                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
                                                                      5⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3268
                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-4769.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-4769.exe
                                                                      5⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3124
                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
                                                                      5⤵
                                                                        PID:4444
                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-33518.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-33518.exe
                                                                        5⤵
                                                                          PID:4312
                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-62735.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-62735.exe
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:772
                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:2220
                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
                                                                            6⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:2964
                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-10154.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-10154.exe
                                                                              7⤵
                                                                                PID:1912
                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-43293.exe
                                                                                  8⤵
                                                                                    PID:2540
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-52515.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-52515.exe
                                                                                    8⤵
                                                                                      PID:4120
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
                                                                                      8⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:4940
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-36428.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-36428.exe
                                                                                    7⤵
                                                                                      PID:1704
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
                                                                                      7⤵
                                                                                        PID:3396
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
                                                                                        7⤵
                                                                                          PID:4020
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
                                                                                          7⤵
                                                                                            PID:4732
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
                                                                                            7⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:5008
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
                                                                                          6⤵
                                                                                            PID:112
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-5318.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-5318.exe
                                                                                            6⤵
                                                                                              PID:2716
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe
                                                                                              6⤵
                                                                                                PID:3328
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-9234.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-9234.exe
                                                                                                6⤵
                                                                                                  PID:3076
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-35888.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-35888.exe
                                                                                                  6⤵
                                                                                                    PID:4468
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-34653.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-34653.exe
                                                                                                    6⤵
                                                                                                      PID:5088
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-44448.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-44448.exe
                                                                                                    5⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:2232
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exe
                                                                                                      6⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:2948
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
                                                                                                      6⤵
                                                                                                        PID:3236
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-13748.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-13748.exe
                                                                                                        6⤵
                                                                                                          PID:3972
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
                                                                                                          6⤵
                                                                                                            PID:4612
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-23557.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-23557.exe
                                                                                                            6⤵
                                                                                                              PID:4712
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
                                                                                                            5⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:1468
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-28417.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-28417.exe
                                                                                                            5⤵
                                                                                                              PID:1672
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
                                                                                                              5⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:3700
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-46914.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-46914.exe
                                                                                                              5⤵
                                                                                                                PID:4104
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
                                                                                                                5⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:4908
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-18385.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-18385.exe
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:1548
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
                                                                                                                5⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:2120
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-5178.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-5178.exe
                                                                                                                  6⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:2684
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-33730.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-33730.exe
                                                                                                                  6⤵
                                                                                                                    PID:1092
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-29570.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-29570.exe
                                                                                                                    6⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:3512
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-47419.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-47419.exe
                                                                                                                    6⤵
                                                                                                                      PID:4224
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-11746.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-11746.exe
                                                                                                                      6⤵
                                                                                                                        PID:4192
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-4830.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-4830.exe
                                                                                                                      5⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:2368
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
                                                                                                                      5⤵
                                                                                                                        PID:3340
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
                                                                                                                        5⤵
                                                                                                                          PID:3864
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-18822.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-18822.exe
                                                                                                                          5⤵
                                                                                                                            PID:4464
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-56184.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-56184.exe
                                                                                                                            5⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:4700
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-18467.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-18467.exe
                                                                                                                          4⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:920
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exe
                                                                                                                            5⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:1052
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
                                                                                                                            5⤵
                                                                                                                              PID:4448
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-48039.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-48039.exe
                                                                                                                              5⤵
                                                                                                                                PID:5080
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-1349.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-1349.exe
                                                                                                                              4⤵
                                                                                                                                PID:868
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe
                                                                                                                                4⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:3960
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
                                                                                                                                4⤵
                                                                                                                                  PID:3736
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-51870.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-51870.exe
                                                                                                                                  4⤵
                                                                                                                                    PID:4960
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
                                                                                                                                    4⤵
                                                                                                                                      PID:4820
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:1160
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-49051.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-49051.exe
                                                                                                                                      4⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                      PID:2596
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
                                                                                                                                        5⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:2096
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-15632.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-15632.exe
                                                                                                                                          6⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:392
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-59547.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-59547.exe
                                                                                                                                            7⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:1360
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-44981.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-44981.exe
                                                                                                                                            7⤵
                                                                                                                                              PID:2868
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
                                                                                                                                              7⤵
                                                                                                                                                PID:3976
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-9608.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-9608.exe
                                                                                                                                                7⤵
                                                                                                                                                  PID:3140
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
                                                                                                                                                  7⤵
                                                                                                                                                    PID:4640
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
                                                                                                                                                  6⤵
                                                                                                                                                    PID:876
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-33443.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-33443.exe
                                                                                                                                                    6⤵
                                                                                                                                                      PID:1488
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
                                                                                                                                                      6⤵
                                                                                                                                                        PID:3936
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-35226.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-35226.exe
                                                                                                                                                        6⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:3796
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
                                                                                                                                                        6⤵
                                                                                                                                                          PID:4688
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-41671.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-41671.exe
                                                                                                                                                        5⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        PID:584
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
                                                                                                                                                          6⤵
                                                                                                                                                            PID:2524
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-64990.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-64990.exe
                                                                                                                                                            6⤵
                                                                                                                                                              PID:2900
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
                                                                                                                                                              6⤵
                                                                                                                                                                PID:3416
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:4836
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-2557.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-2557.exe
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:4812
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-29893.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-29893.exe
                                                                                                                                                                  5⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:1708
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-15930.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-15930.exe
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:2100
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-51280.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-51280.exe
                                                                                                                                                                    5⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:3544
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-51398.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-51398.exe
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:3220
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
                                                                                                                                                                      5⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:4520
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-2557.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-2557.exe
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:2168
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-38090.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-38090.exe
                                                                                                                                                                      4⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                      PID:1356
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-61537.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-61537.exe
                                                                                                                                                                        5⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                        PID:2972
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-4477.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-4477.exe
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:2104
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-51255.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-51255.exe
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:2152
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-37220.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-37220.exe
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:3468
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-58816.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-58816.exe
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:3632
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:4588
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-16132.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-16132.exe
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:3028
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-64990.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-64990.exe
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:852
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:3440
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-25769.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-25769.exe
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:3652
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-18822.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-18822.exe
                                                                                                                                                                                        5⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4480
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-45624.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-45624.exe
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:2192
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-63492.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-63492.exe
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:2124
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:1872
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-15264.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-15264.exe
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:3728
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-9171.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-9171.exe
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:3604
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-10661.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-10661.exe
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:4284
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:5004
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:1884
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-19751.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-19751.exe
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:2748
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-26426.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-26426.exe
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:3676
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-6803.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-6803.exe
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:4136
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-56090.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-56090.exe
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:4932
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-44182.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-44182.exe
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                          PID:2236
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                            PID:1916
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-19693.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-19693.exe
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                              PID:3040
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-23840.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-23840.exe
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:2952
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-23484.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-23484.exe
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:3300
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-28569.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-28569.exe
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:3932
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-44023.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-44023.exe
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:4416
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-55654.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-55654.exe
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:4436
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-52360.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-52360.exe
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:2976
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:4004
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:3756
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-26414.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-26414.exe
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:5040
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:4880
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-65364.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-65364.exe
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                            PID:1588
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-44192.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-44192.exe
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:1568
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-31001.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-31001.exe
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                    PID:2472
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:3276
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:3848
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-29555.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-29555.exe
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:4384
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:4392
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-19708.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-19708.exe
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:1288
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:3372
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:4024
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                            PID:4784
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-60032.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-60032.exe
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:5072
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:2536
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-31390.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-31390.exe
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:612
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-51280.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-51280.exe
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:3536
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-26300.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-26300.exe
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:3928
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-14357.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-14357.exe
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:4540
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-60174.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-60174.exe
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:4984
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-49523.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-49523.exe
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                      PID:2244
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:2296
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-45842.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-45842.exe
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:3064
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:2836
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-58354.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-58354.exe
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:1700
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-61724.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-61724.exe
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:3432
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-34435.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-34435.exe
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:3992
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-35357.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-35357.exe
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:4460
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:4360
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-15831.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-15831.exe
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:3008
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                          PID:4064
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:5024
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-58454.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-58454.exe
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:4920
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-64990.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-64990.exe
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:2036
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-28192.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-28192.exe
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:2420
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-46722.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-46722.exe
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                  PID:3368
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                    PID:4564
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-32992.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-32992.exe
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                  PID:2488
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:2936
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-65116.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-65116.exe
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                        PID:3100
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-45762.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-45762.exe
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:3664
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-6578.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-6578.exe
                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                            PID:4112
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-11554.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-11554.exe
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:4956
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:2016
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-57080.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-57080.exe
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:3620
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:3920
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:4664
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                  PID:2544
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:1852
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                          PID:784
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-50731.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-50731.exe
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                            PID:3012
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe
                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                              PID:3148
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-37806.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-37806.exe
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                PID:4792
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-4206.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-4206.exe
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:5104
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-63875.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-63875.exe
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                PID:1604
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-13314.exe
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                  PID:996
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                    PID:3840
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-30361.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-30361.exe
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                      PID:5000
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:2928
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-33836.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-33836.exe
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:2784
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-20658.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-20658.exe
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:3768
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:3520
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-62646.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-62646.exe
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:4604
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-39223.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-39223.exe
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:4924
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-15132.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-15132.exe
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                            PID:2872
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                              PID:1848
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                PID:2980
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-43654.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-43654.exe
                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                  PID:2564
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                    PID:1900
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                        PID:3096
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-45088.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-45088.exe
                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                          PID:3852
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                            PID:4504
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-30823.exe
                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-30823.exe
                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                            PID:2680
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-19769.exe
                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-19769.exe
                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:2876
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                              PID:3816
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                PID:3696
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-22193.exe
                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-22193.exe
                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5052
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                PID:2804
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-61846.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-61846.exe
                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:1376
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-58354.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-58354.exe
                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1600
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-61724.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-61724.exe
                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3428
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-58816.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-58816.exe
                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3872
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4620
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-38420.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-38420.exe
                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1004
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-5318.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-5318.exe
                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2828
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3324
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3584
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4628
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-3114.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-3114.exe
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                PID:2612
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exe
                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                  PID:2400
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-39553.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-39553.exe
                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:692
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3244
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:804
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4772
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-6062.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-6062.exe
                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4888
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1976
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-64466.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-64466.exe
                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2920
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-25540.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-25540.exe
                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3120
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4152
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-59470.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-59470.exe
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                  PID:2404
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3068
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:2068
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4084
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-25752.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-25752.exe
                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1416
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4644
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-27207.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-27207.exe
                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2504
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1608
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-34744.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-34744.exe
                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3528
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-2926.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-2926.exe
                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3212
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-63781.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-63781.exe
                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4488
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-38422.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-38422.exe
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2600
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-52777.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-52777.exe
                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-44957.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-44957.exe
                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1008
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-833.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-833.exe
                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4012
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe
                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-13565.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-13565.exe
                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-53839.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-53839.exe
                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3144
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-43724.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-43724.exe
                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2256
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-49148.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-49148.exe
                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2476
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-36858.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-36858.exe
                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3892
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-52388.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-52388.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-65219.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-65219.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-19564.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-19564.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:860
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-56089.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-56089.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-51826.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-51826.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:372
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-52531.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-52531.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-36428.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-36428.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-38504.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3180
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-18441.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-18441.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-5371.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-5371.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1072
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-19168.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-19168.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3904
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-49862.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-49862.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-47462.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-47462.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-5209.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-5209.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2076
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-20479.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-20479.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:904
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-40344.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-40344.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3556
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-29700.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-29700.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-2493.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-2493.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-47466.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-47466.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-35436.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-35436.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-22225.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-22225.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-24899.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-24899.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-10948.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-10948.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-2709.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-2709.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-63113.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-63113.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-43817.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-43817.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-39722.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-39722.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-11540.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-11540.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-9433.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-61671.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-61671.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-58435.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-58435.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-43480.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-43480.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-2557.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-2557.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-27230.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-27230.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-205.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-205.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-14834.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-14834.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-51859.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-51859.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-59516.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-59516.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-1225.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-1225.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-16798.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-16798.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-51822.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-51822.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-24004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-24004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-38158.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-38158.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-61543.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-61543.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-49272.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-49272.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-5690.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-5690.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-5582.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-5582.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-45558.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-45558.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-40103.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-40103.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-15632.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-15632.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-20186.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-20186.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-10419.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-10419.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-57446.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-57446.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-60240.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-60240.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-30891.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-30891.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-11746.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-11746.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-7824.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-7824.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-51627.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-51627.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-63450.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-63450.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-27667.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-27667.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-57080.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-57080.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-25340.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-25340.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-21757.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-21757.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-36071.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-36071.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-36221.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-36221.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-50689.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-50689.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-22751.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-22751.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-31757.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-31757.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-19244.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-7022.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-7022.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-13335.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-13335.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-41643.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-41643.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-8108.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-8108.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-52382.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-52382.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-9368.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-9368.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-34910.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-34910.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4668

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Network