fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe
Size

468KB
MD5

751fd40bf48cd83ce64ebcc998253668
SHA1

6309e07d7c20e5ec6ab4f64fa1c679e5d26bdc64
SHA256

fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805
SHA512

247a4aa413c67b860c52302d89b6fa55c01c5b0963d95672170a2396c7f2b918d52379efdb05f1fd1dc4cadf88985ec467125fb9c368c614dc365e938af6b190
SSDEEP

3072:43elogxaId57tbYZPmcfmbfD/S2DnsIHMQmyeQVqAuQKk3i8uxuljj:434oCb7tCPffmbfIaOwuQDS8uxs

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2680	Unicorn-11310.exe
2836	Unicorn-8596.exe
2880	Unicorn-21595.exe
2560	Unicorn-54990.exe
532	Unicorn-4948.exe
2580	Unicorn-18683.exe
2440	Unicorn-24814.exe
2968	Unicorn-64108.exe
2172	Unicorn-43859.exe
1192	Unicorn-17212.exe
2316	Unicorn-17212.exe
1564	Unicorn-34.exe
2300	Unicorn-299.exe
2764	Unicorn-59706.exe
2800	Unicorn-45971.exe
2208	Unicorn-24773.exe
2512	Unicorn-56796.exe
2280	Unicorn-27461.exe
868	Unicorn-10495.exe
1512	Unicorn-51794.exe
1264	Unicorn-24637.exe
2360	Unicorn-44311.exe
2248	Unicorn-24253.exe
1180	Unicorn-44119.exe
1296	Unicorn-11062.exe
1576	Unicorn-35681.exe
892	Unicorn-12909.exe
2272	Unicorn-7044.exe
2344	Unicorn-42317.exe
1856	Unicorn-57998.exe
336	Unicorn-46794.exe
2956	Unicorn-40702.exe
3040	Unicorn-29881.exe
2308	Unicorn-35907.exe
1516	Unicorn-46113.exe
2848	Unicorn-22368.exe
2844	Unicorn-36986.exe
2572	Unicorn-21984.exe
1396	Unicorn-17878.exe
2548	Unicorn-34214.exe
3016	Unicorn-11423.exe
588	Unicorn-56711.exe
992	Unicorn-43520.exe
628	Unicorn-14220.exe
3068	Unicorn-59892.exe
1236	Unicorn-30365.exe
2792	Unicorn-5584.exe
1552	Unicorn-23466.exe
1872	Unicorn-63146.exe
2784	Unicorn-13945.exe
2032	Unicorn-59512.exe
1708	Unicorn-56520.exe
1712	Unicorn-16058.exe
1596	Unicorn-57967.exe
2268	Unicorn-8117.exe
2224	Unicorn-47313.exe
2116	Unicorn-1641.exe
1404	Unicorn-20700.exe
2448	Unicorn-44044.exe
2364	Unicorn-63395.exe
344	Unicorn-17724.exe
1540	Unicorn-13618.exe
1784	Unicorn-33484.exe
912	Unicorn-59642.exe

Loads dropped DLL 64 IoCs

pid	Process
2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe
2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe
2680	Unicorn-11310.exe
2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe
2680	Unicorn-11310.exe
2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe
2836	Unicorn-8596.exe
2836	Unicorn-8596.exe
2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe
2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe
2680	Unicorn-11310.exe
2680	Unicorn-11310.exe
2880	Unicorn-21595.exe
2880	Unicorn-21595.exe
2560	Unicorn-54990.exe
2560	Unicorn-54990.exe
2836	Unicorn-8596.exe
2836	Unicorn-8596.exe
2580	Unicorn-18683.exe
2440	Unicorn-24814.exe
2580	Unicorn-18683.exe
2440	Unicorn-24814.exe
2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe
532	Unicorn-4948.exe
2680	Unicorn-11310.exe
532	Unicorn-4948.exe
2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe
2680	Unicorn-11310.exe
2880	Unicorn-21595.exe
2880	Unicorn-21595.exe
2968	Unicorn-64108.exe
2968	Unicorn-64108.exe
2560	Unicorn-54990.exe
2560	Unicorn-54990.exe
2172	Unicorn-43859.exe
2172	Unicorn-43859.exe
2836	Unicorn-8596.exe
2836	Unicorn-8596.exe
1192	Unicorn-17212.exe
1192	Unicorn-17212.exe
2580	Unicorn-18683.exe
2580	Unicorn-18683.exe
2316	Unicorn-17212.exe
2316	Unicorn-17212.exe
2440	Unicorn-24814.exe
2440	Unicorn-24814.exe
2764	Unicorn-59706.exe
2764	Unicorn-59706.exe
2300	Unicorn-299.exe
2300	Unicorn-299.exe
2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe
2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe
2880	Unicorn-21595.exe
2680	Unicorn-11310.exe
2680	Unicorn-11310.exe
2880	Unicorn-21595.exe
532	Unicorn-4948.exe
532	Unicorn-4948.exe
2208	Unicorn-24773.exe
2208	Unicorn-24773.exe
2968	Unicorn-64108.exe
2968	Unicorn-64108.exe
2280	Unicorn-27461.exe
2280	Unicorn-27461.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20982.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24253.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe
2680	Unicorn-11310.exe
2836	Unicorn-8596.exe
2880	Unicorn-21595.exe
2560	Unicorn-54990.exe
2440	Unicorn-24814.exe
2580	Unicorn-18683.exe
532	Unicorn-4948.exe
2968	Unicorn-64108.exe
2172	Unicorn-43859.exe
1192	Unicorn-17212.exe
2300	Unicorn-299.exe
2800	Unicorn-45971.exe
2316	Unicorn-17212.exe
2764	Unicorn-59706.exe
1564	Unicorn-34.exe
2208	Unicorn-24773.exe
2512	Unicorn-56796.exe
2280	Unicorn-27461.exe
868	Unicorn-10495.exe
1512	Unicorn-51794.exe
2360	Unicorn-44311.exe
2248	Unicorn-24253.exe
1264	Unicorn-24637.exe
1180	Unicorn-44119.exe
1296	Unicorn-11062.exe
1576	Unicorn-35681.exe
892	Unicorn-12909.exe
2272	Unicorn-7044.exe
2344	Unicorn-42317.exe
1856	Unicorn-57998.exe
336	Unicorn-46794.exe
2956	Unicorn-40702.exe
3040	Unicorn-29881.exe
2308	Unicorn-35907.exe
1516	Unicorn-46113.exe
2848	Unicorn-22368.exe
2844	Unicorn-36986.exe
2572	Unicorn-21984.exe
2548	Unicorn-34214.exe
1396	Unicorn-17878.exe
3016	Unicorn-11423.exe
588	Unicorn-56711.exe
992	Unicorn-43520.exe
3068	Unicorn-59892.exe
2792	Unicorn-5584.exe
628	Unicorn-14220.exe
1236	Unicorn-30365.exe
1552	Unicorn-23466.exe
1872	Unicorn-63146.exe
2784	Unicorn-13945.exe
1708	Unicorn-56520.exe
2032	Unicorn-59512.exe
1712	Unicorn-16058.exe
1596	Unicorn-57967.exe
2268	Unicorn-8117.exe
2224	Unicorn-47313.exe
2116	Unicorn-1641.exe
1404	Unicorn-20700.exe
2448	Unicorn-44044.exe
2364	Unicorn-63395.exe
344	Unicorn-17724.exe
1540	Unicorn-13618.exe
1784	Unicorn-33484.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2680	2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe	30
PID 2724 wrote to memory of 2680	2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe	30
PID 2724 wrote to memory of 2680	2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe	30
PID 2724 wrote to memory of 2680	2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe	30
PID 2680 wrote to memory of 2836	2680	Unicorn-11310.exe	31
PID 2680 wrote to memory of 2836	2680	Unicorn-11310.exe	31
PID 2680 wrote to memory of 2836	2680	Unicorn-11310.exe	31
PID 2680 wrote to memory of 2836	2680	Unicorn-11310.exe	31
PID 2724 wrote to memory of 2880	2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe	32
PID 2724 wrote to memory of 2880	2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe	32
PID 2724 wrote to memory of 2880	2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe	32
PID 2724 wrote to memory of 2880	2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe	32
PID 2836 wrote to memory of 2560	2836	Unicorn-8596.exe	33
PID 2836 wrote to memory of 2560	2836	Unicorn-8596.exe	33
PID 2836 wrote to memory of 2560	2836	Unicorn-8596.exe	33
PID 2836 wrote to memory of 2560	2836	Unicorn-8596.exe	33
PID 2724 wrote to memory of 2580	2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe	34
PID 2724 wrote to memory of 2580	2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe	34
PID 2724 wrote to memory of 2580	2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe	34
PID 2724 wrote to memory of 2580	2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe	34
PID 2680 wrote to memory of 532	2680	Unicorn-11310.exe	35
PID 2680 wrote to memory of 532	2680	Unicorn-11310.exe	35
PID 2680 wrote to memory of 532	2680	Unicorn-11310.exe	35
PID 2680 wrote to memory of 532	2680	Unicorn-11310.exe	35
PID 2880 wrote to memory of 2440	2880	Unicorn-21595.exe	36
PID 2880 wrote to memory of 2440	2880	Unicorn-21595.exe	36
PID 2880 wrote to memory of 2440	2880	Unicorn-21595.exe	36
PID 2880 wrote to memory of 2440	2880	Unicorn-21595.exe	36
PID 2560 wrote to memory of 2968	2560	Unicorn-54990.exe	37
PID 2560 wrote to memory of 2968	2560	Unicorn-54990.exe	37
PID 2560 wrote to memory of 2968	2560	Unicorn-54990.exe	37
PID 2560 wrote to memory of 2968	2560	Unicorn-54990.exe	37
PID 2836 wrote to memory of 2172	2836	Unicorn-8596.exe	38
PID 2836 wrote to memory of 2172	2836	Unicorn-8596.exe	38
PID 2836 wrote to memory of 2172	2836	Unicorn-8596.exe	38
PID 2836 wrote to memory of 2172	2836	Unicorn-8596.exe	38
PID 2440 wrote to memory of 2316	2440	Unicorn-24814.exe	40
PID 2440 wrote to memory of 2316	2440	Unicorn-24814.exe	40
PID 2440 wrote to memory of 2316	2440	Unicorn-24814.exe	40
PID 2440 wrote to memory of 2316	2440	Unicorn-24814.exe	40
PID 2580 wrote to memory of 1192	2580	Unicorn-18683.exe	39
PID 2580 wrote to memory of 1192	2580	Unicorn-18683.exe	39
PID 2580 wrote to memory of 1192	2580	Unicorn-18683.exe	39
PID 2580 wrote to memory of 1192	2580	Unicorn-18683.exe	39
PID 532 wrote to memory of 2300	532	Unicorn-4948.exe	42
PID 532 wrote to memory of 2300	532	Unicorn-4948.exe	42
PID 532 wrote to memory of 2300	532	Unicorn-4948.exe	42
PID 532 wrote to memory of 2300	532	Unicorn-4948.exe	42
PID 2724 wrote to memory of 1564	2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe	41
PID 2724 wrote to memory of 1564	2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe	41
PID 2724 wrote to memory of 1564	2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe	41
PID 2724 wrote to memory of 1564	2724	fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe	41
PID 2680 wrote to memory of 2764	2680	Unicorn-11310.exe	43
PID 2680 wrote to memory of 2764	2680	Unicorn-11310.exe	43
PID 2680 wrote to memory of 2764	2680	Unicorn-11310.exe	43
PID 2680 wrote to memory of 2764	2680	Unicorn-11310.exe	43
PID 2880 wrote to memory of 2800	2880	Unicorn-21595.exe	44
PID 2880 wrote to memory of 2800	2880	Unicorn-21595.exe	44
PID 2880 wrote to memory of 2800	2880	Unicorn-21595.exe	44
PID 2880 wrote to memory of 2800	2880	Unicorn-21595.exe	44
PID 2968 wrote to memory of 2208	2968	Unicorn-64108.exe	45
PID 2968 wrote to memory of 2208	2968	Unicorn-64108.exe	45
PID 2968 wrote to memory of 2208	2968	Unicorn-64108.exe	45
PID 2968 wrote to memory of 2208	2968	Unicorn-64108.exe	45

C:\Users\Admin\AppData\Local\Temp\fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe
"C:\Users\Admin\AppData\Local\Temp\fa66789f0f2435f7d44de7099752be157821d733f2da62ad32403fe0b68cc805.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11310.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11310.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8596.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54990.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64108.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24773.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57998.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44044.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53818.exe
        9⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6271.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3237.exe
        9⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51017.exe
        8⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
        8⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30875.exe
        8⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe
        8⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63395.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7577.exe
        7⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1795.exe
        7⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49046.exe
        7⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7070.exe
        7⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46794.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15371.exe
        8⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16802.exe
        8⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        8⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64214.exe
        8⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43341.exe
        7⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25872.exe
        7⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
        7⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exe
        6⤵
        Executes dropped EXE
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40848.exe
        7⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60462.exe
        8⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30226.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        8⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
        7⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
        7⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20080.exe
        7⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21027.exe
        7⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1792.exe
        6⤵
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16701.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17199.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50552.exe
        6⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56796.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35907.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32716.exe
        7⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        8⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5766.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10363.exe
        8⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56390.exe
        7⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10460.exe
        7⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48779.exe
        7⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64739.exe
        6⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe
        7⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe
        7⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        6⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17206.exe
        6⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
        6⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46113.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        6⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34018.exe
        7⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        7⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37424.exe
        7⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
        7⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47729.exe
        6⤵
        
        PID:444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23487.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50022.exe
        6⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        5⤵
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62524.exe
        6⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42003.exe
        6⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        6⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37837.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35612.exe
        5⤵
        
        PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36403.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34265.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29021.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40702.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17724.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27055.exe
        8⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5766.exe
        8⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        8⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58502.exe
        7⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        7⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe
        7⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        7⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40793.exe
        7⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6271.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52822.exe
        7⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        6⤵
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20880.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17206.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        6⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29881.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18684.exe
        6⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35586.exe
        7⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
        7⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
        7⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20080.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38790.exe
        7⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10733.exe
        6⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe
        6⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36403.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        6⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe
        6⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64935.exe
        5⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        6⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9032.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28137.exe
        7⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17086.exe
        6⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5103.exe
        5⤵
        
        PID:664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12561.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47716.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10495.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55544.exe
        6⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5578.exe
        7⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        7⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20653.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12220.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19189.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe
        6⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54319.exe
        5⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40451.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13140.exe
        5⤵
        
        PID:480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28038.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19566.exe
        5⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12621.exe
        5⤵
        
        PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36986.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        5⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3552.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22454.exe
        5⤵
        
        PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39842.exe
      4⤵
      PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6626.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28268.exe
      4⤵
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18012.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
      4⤵
      PID:5212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4948.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-299.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43520.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe
        7⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31896.exe
        7⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36101.exe
        7⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe
        7⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53954.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44908.exe
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59892.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5345.exe
        6⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        6⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52230.exe
        5⤵
        
        PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17206.exe
        5⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
        5⤵
        
        PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1641.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe
        6⤵
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53489.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51017.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        5⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
        5⤵
        
        PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20700.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
        5⤵
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26137.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22558.exe
        6⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
        5⤵
        
        PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20080.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21027.exe
        5⤵
        
        PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35269.exe
      4⤵
      PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28190.exe
      4⤵
      PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11010.exe
      4⤵
      PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1876.exe
      4⤵
      PID:5152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59706.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44119.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57967.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
        6⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        6⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        5⤵
        
        PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10460.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7070.exe
        5⤵
        
        PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
        5⤵
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62657.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4317.exe
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12220.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19189.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6341.exe
        5⤵
        
        PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40016.exe
      4⤵
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26137.exe
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55039.exe
        5⤵
        
        PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38741.exe
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17736.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
      4⤵
      PID:5044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12909.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13945.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54496.exe
        5⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44006.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        6⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
        5⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23511.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        5⤵
        
        PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10147.exe
      4⤵
      PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe
      4⤵
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5542.exe
      4⤵
      PID:6028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56520.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
      4⤵
      PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13490.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
        5⤵
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
      4⤵
      PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
      4⤵
      PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47678.exe
      4⤵
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
      4⤵
      PID:5360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3851.exe
    3⤵
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29672.exe
      4⤵
      PID:4796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
    3⤵
    PID:2508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6737.exe
    3⤵
    PID:3960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12677.exe
    3⤵
    PID:4640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
    3⤵
    PID:5244
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21595.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21595.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24814.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17212.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44311.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11423.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37241.exe
        7⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44543.exe
        8⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
        9⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43261.exe
        9⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25676.exe
        9⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53604.exe
        8⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
        8⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe
        8⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65347.exe
        7⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23487.exe
        7⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33493.exe
        7⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46514.exe
        6⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11317.exe
        7⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23172.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31542.exe
        7⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6404.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11702.exe
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19566.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6878.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        6⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43321.exe
        7⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        7⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58349.exe
        7⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
        6⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        6⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
        5⤵
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36476.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        6⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17206.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        5⤵
        
        PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24253.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47812.exe
        6⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14370.exe
        7⤵
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
        6⤵
        
        PID:692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20367.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3545.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
        6⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        5⤵
        
        PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        5⤵
        
        PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28038.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19566.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7070.exe
        5⤵
        
        PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23466.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35534.exe
        5⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe
        6⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44767.exe
        5⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54615.exe
      4⤵
      PID:1772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16701.exe
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63823.exe
      4⤵
      PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34024.exe
      4⤵
      PID:4676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45971.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
      4⤵
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        5⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42396.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
        5⤵
        
        PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20871.exe
      4⤵
      PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54099.exe
      4⤵
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
      4⤵
      PID:5440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16058.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        5⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26137.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        6⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7467.exe
        5⤵
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36704.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36101.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
        5⤵
        
        PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
      4⤵
      PID:1908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55277.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
      4⤵
      PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
      4⤵
      PID:5540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe
      4⤵
      PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
      4⤵
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
      4⤵
      PID:3064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
    3⤵
    PID:1108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17736.exe
    3⤵
    PID:4316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44973.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18683.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18683.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17212.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51794.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21984.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32555.exe
        6⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
        7⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9930.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        7⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
        6⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
        6⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47678.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
        6⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35185.exe
        5⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40656.exe
        6⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11317.exe
        7⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23172.exe
        7⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15013.exe
        7⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5766.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        6⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        6⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61464.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25367.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33734.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        5⤵
        
        PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe
        5⤵
        
        PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        5⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        5⤵
        
        PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2152.exe
      4⤵
      PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
      4⤵
      PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53562.exe
      4⤵
      PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7070.exe
      4⤵
      PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24637.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63146.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31896.exe
        6⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46090.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        6⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21006.exe
        5⤵
        
        PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19566.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56079.exe
        5⤵
        
        PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe
      4⤵
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23487.exe
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1698.exe
      4⤵
      PID:4656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59512.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44543.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53604.exe
      4⤵
      PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41575.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55549.exe
      4⤵
      PID:5588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51699.exe
    3⤵
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
      4⤵
      PID:5168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
    3⤵
    PID:3756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-671.exe
    3⤵
    PID:4404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34024.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34024.exe
    3⤵
    PID:4808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34214.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
      4⤵
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34483.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26266.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        5⤵
        
        PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
      4⤵
      PID:796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
      4⤵
      PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47678.exe
      4⤵
      PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
      4⤵
      PID:4724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32968.exe
    3⤵
    PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26137.exe
      4⤵
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39086.exe
      4⤵
      PID:4988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31827.exe
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe
    3⤵
    PID:3976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22477.exe
    3⤵
    PID:4700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7070.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35681.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35681.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14220.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35534.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8120.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6271.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3237.exe
        5⤵
        
        PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51786.exe
      4⤵
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13926.exe
      4⤵
      PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44767.exe
      4⤵
      PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
      4⤵
      PID:5320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34521.exe
    3⤵
    PID:2984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe
    3⤵
    PID:3536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe
    3⤵
    PID:4164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5584.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5584.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45954.exe
    3⤵
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5578.exe
      4⤵
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
      4⤵
      PID:5144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
    3⤵
    PID:2976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
    3⤵
    PID:3260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3552.exe
    3⤵
    PID:4384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21027.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21027.exe
    3⤵
    PID:5924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27186.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27186.exe
  2⤵
  PID:2860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7498.exe
    3⤵
    PID:3420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58690.exe
    3⤵
    PID:4380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42205.exe
    3⤵
    PID:4924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2161.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2161.exe
  2⤵
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64754.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64754.exe
  2⤵
  PID:2020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15066.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15066.exe
  2⤵
  PID:2464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22206.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22206.exe
  2⤵
  PID:5180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-17212.exe

Filesize
468KB

MD5
603ef0fa9de6e1cc52984c47f285323b

SHA1
5424dab5ede1a9cc1be6930332f89b64b54a4475

SHA256
e82f6d335215cb978699c4eae51995688e57f4edced0e7df965719742fa86e11

SHA512
46ff2a16752cded9828f22a0e66c0822afff166de66b9bdebdcc28a7245604b2e2e1cdfa4f1084e18269ae028f88eddb5993fa2b3a7ce4450dbd2985505be648

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24814.exe

Filesize
468KB

MD5
1901054351c16d4babd21b7c0de91014

SHA1
dd7eba863d0ee451b061f52f97389305be98d8e4

SHA256
d3d9b803547e34edaab0256ae1bfdaaabf3342a69e31ba1b90493cf568053fb1

SHA512
55f5b0b7a8e51392b6aa386278c2dbd2d0ae162da247e438282b8945816f0b72d5dc36409e556e09580e403215013e2f73220c7aefc6a7960844dc6f7801269f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54990.exe

Filesize
468KB

MD5
c74dc87726eabc333ba4b9697aa0cc81

SHA1
c9c986e6804a6f0ca060c62b7bdce5b8c2009c3d

SHA256
91fda47008b700f548aac4dcb440d0d143cd19ad8afce8656d2cca2eac89543e

SHA512
2f8a8ea33c942668c307cc0cd077a9b031a391823f4bc2fe7f4daa4b5194aeb8b0ec10340ab13534365edc36ae2d1869a2c88fdf140dbc601f30e9d76e4b1b60

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11310.exe

Filesize
468KB

MD5
8e3685b9c1465e6ed5365fab1e2fab72

SHA1
7f3d8feec312ad605e9e64e9b222f86ef7aa4a39

SHA256
79a1eab811b801ff61060c5cdee3441590438587a7adac164bfe358918149dba

SHA512
e7c15908a479d4e137a32ebd7109b6a42976be67655005c06d7dee589aa35d8dad3ad28f391a964ed97f989ca733e03cfca5d5bf2cc2e4836efab64aa43d6975

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18683.exe

Filesize
468KB

MD5
6131b202d1d2a242e59dbf6f83ffe66c

SHA1
14ddfe6f58b074067d21e7b5d6525c88cb5628d6

SHA256
65dde189e98e85f9184ab5fb4fbb064466d76ff38574086c58bb5afaaf9a88f7

SHA512
7f94b37ea747612590ecf18194ca298cd143b38a1020a77b77769f53315559c28ab3a1cca68fb37bb095c3a495b773043d0fa88b7b3a9c42a94e2735a6956a9f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21595.exe

Filesize
468KB

MD5
d7a81e8b4a24fbb0a2a850d620c5c0bf

SHA1
e36c73143ecedb9224d796ccd502eaa942a05740

SHA256
ec2e21783192c065f352542c92ca127608cc3759395201b889351e7082f8786b

SHA512
0fe34467706c7359e5114c4976f264eba7cbcb426f980a730d60fca1ce8d3d95f65566e6e4d7bf08d85900788e1a25645101faf637fef7a537fd94dd39e5e58a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24773.exe

Filesize
468KB

MD5
7ec677e46e5279e13d88c308e8f5a685

SHA1
72dafcaa940a34b7d16bef3cd4b711f79f242aaf

SHA256
89475c8132257ac6b96838d78efb8d7ef11c200083931002049c6d467bf04a1a

SHA512
d1c300d524daee08c984030eb988df969ec93eac2bc6bb128d41577efbc74096955b0daf93b478b2b6e00215cdec54ff2eef610f11f6cf7881a0f0c0618b4293

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe

Filesize
468KB

MD5
d8f5e7e14965afa732b5d311d7fe6e6f

SHA1
0d913d93ccebbeef4b889e7ad948c25fe93165c9

SHA256
d999b38a914a33065b2824ed8fc7e1dc93cbebd6a1c2d3048a6df673a398ae9f

SHA512
9fb48b507fa64c6e232797bf32bebe7d20662e866e2c7676c87acbc493a0a21a7064e63a491f6878548623e5b2ba9dee69718e5edb967d80f85fcff610ff9285

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-299.exe

Filesize
468KB

MD5
42fd8ac5c39960937f6093691727bb79

SHA1
01d65c6e17b5673f6b3f56149677b721b1dd202c

SHA256
2f8b272d30ee5d838d22ef4faa9cca618a05ead7e6334ad56af9b5a4b97fb452

SHA512
864087caed8ecf4b60b78290c37e68e77dd59bfcd253673c1f272a5da5663219f1c5d718fed410750e34af1cb7b54e9d9536f742d802ce6f51feea2ef42d7d53

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34.exe

Filesize
468KB

MD5
0149ae99a24978349c6434066df434ec

SHA1
87151cb0f349b9c16cad6507f64dd2aee458025c

SHA256
56caa6d898b8c860388bbe2e0f0afb4321329fd7846d847fbb958242ee8103f1

SHA512
e64a1707a3c4c5ddd2b45afa9d98b3fc6b6b3c9ac8d12cce2aaca959adbd5177c3f579f9825d5e87e323988f954973c1951a586e62ec03b3c8770b2c639aa9d7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe

Filesize
468KB

MD5
871d2d4d08fd5a3f59f79dd6f0ba4abf

SHA1
07fe5f07a13bd88e72c460437af56e51536788e1

SHA256
12d07db72e759d4f9090f54f6600e2786e7debfdb5f5718247f105abf01c934c

SHA512
b3b7a0de41f936a09753f1b61f598b8985e2250c2006c590fcd519e54940e20f3f0b8a962ad011e4b7170e15641586a29cc8e77f7dcfd1c5993c275dd0136a75

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45971.exe

Filesize
468KB

MD5
f44387a91f33f42e395fcc60eb1deaef

SHA1
35ee11f20c9cba85fd107266fa43887f246845ec

SHA256
d37ef5972c496cf602333f2a89dfac54f98cf9e4da0ae1a4ce018821219b25a3

SHA512
4f53b842673d2731db258e14628006da21604a390261a0c0e834421a94e5ec92917a50bea9bb6a5d994ee1335df768cf57eb067e191bea0d52d17e57c331823a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4948.exe

Filesize
468KB

MD5
6c54a088f51259479b88441ea4b32b82

SHA1
01dcfec7b3c927b8fbeb147e3b787d5405f3e34a

SHA256
a3831dc0029503b8b8c9cccc1fb4cefbe202e8ca6771677e1dadee2d9085a9f7

SHA512
a5595e8a069d57fafb600ae2cf98e5856618656f612abeb72e9d8bad5fe97c8fb74c8d071f89aa8252c7aa2b214896985c866a380eaedea217f33ece93f98b86

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56796.exe

Filesize
468KB

MD5
250a3ba85f202d99cf44147ce2a793d7

SHA1
95eea7948e4b9853bd30855ffd3a7bdc433e6d45

SHA256
7c2bef6f752e44b0571f2f7f2b97557f1096f4b13e10762af2d25373cb7319b7

SHA512
09c512505e2d53c81a8cc7d2675da9f6aac87b96a196b5c209b9e3ef763f7179368b6296c91c8c2d4109760fede238dbcd7efac04d0decfc3e59c6658e3fd13b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59706.exe

Filesize
468KB

MD5
e888bb285029405ab9943337c65cbe90

SHA1
4c2111aace630e60e79a3c77d38bb5fd314cfcea

SHA256
b36b85d8f311d9158e02d9810ae07d194047de4b80be1c960400a115a02dde3f

SHA512
aca600a7ff0a976f8666d8027f6286dd94fea01eb17cbec181b1adf095367e83ee0c872c673e2d39d597b8fb935485085977b27731781d59d653c97be60428f0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64108.exe

Filesize
468KB

MD5
e176e8213c1573f80429bf92c9bf7dba

SHA1
f9bbbeefec0ccc11df59e5fd9c10718d0c1f5627

SHA256
0fa347f2f4f6579b1b7f0f11a122a12c663ce2086f8cb3b93bc8c132e6ac9208

SHA512
21670f7bb2e79db216ca0fe11bd74d4a2a373a9e2da1dd61115fb26a5b1b385ed50ece43069d84c6a9698a66208cdbde8f1b3e8021765dfa645eb4d152843f5e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8596.exe

Filesize
468KB

MD5
1d6cfd2bc37941fabf226d06a7227078

SHA1
ef48d0bfe536f41f1f3f1bb26fac60515528b8f3

SHA256
47d792e414f7edb43f0e7e1e0a29f6dff3dd3a8229261649ebbfbd9d97aa45c5

SHA512
c16a2196f9b3f7159f5eb5ec6f5314da44ae7f784cf4279bd299d353dd091a057cd015e8bdc83afc4537d4bd3ae37a6628e1077711f35a6210d620401d212344

Download Submit