db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153

Analysis

max time kernel
149s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe
Size

468KB
MD5

d8f31b3812a80d4116c583723ae59ef3
SHA1

e07da467e46f68805da22eded62782c25d5fb3ac
SHA256

db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153
SHA512

a8195a265cfffcbbf8e4a2847136d9303b956ae9f8744e5a24a6ed326dea9fabd075bb2397983ae07db2761effec5ed433a7145af6536ab46e66c697a09ca635
SSDEEP

3072:4MeAoFI/IU57tbYEPzmjbfD/VCLHsIp9QmHeQVYoq2xLEPKuWYl5:4Mpo1c7t7PqjbfF0k+q2tyKuW

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2568	Unicorn-9576.exe
2920	Unicorn-23028.exe
3036	Unicorn-35834.exe
2964	Unicorn-47506.exe
3016	Unicorn-8511.exe
2892	Unicorn-18726.exe
2784	Unicorn-27448.exe
1632	Unicorn-40381.exe
2456	Unicorn-4511.exe
1856	Unicorn-12752.exe
1948	Unicorn-53593.exe
1956	Unicorn-55631.exe
1564	Unicorn-33727.exe
2480	Unicorn-8476.exe
2448	Unicorn-9078.exe
1768	Unicorn-14335.exe
2436	Unicorn-6722.exe
1260	Unicorn-63152.exe
2632	Unicorn-44985.exe
2200	Unicorn-34071.exe
2108	Unicorn-47402.exe
1348	Unicorn-51751.exe
1208	Unicorn-18887.exe
1356	Unicorn-12756.exe
1932	Unicorn-31693.exe
2600	Unicorn-55643.exe
456	Unicorn-11081.exe
1436	Unicorn-26863.exe
2664	Unicorn-39115.exe
816	Unicorn-5736.exe
2580	Unicorn-15387.exe
1568	Unicorn-26370.exe
2012	Unicorn-21583.exe
2548	Unicorn-64470.exe
2396	Unicorn-60941.exe
2880	Unicorn-15269.exe
1500	Unicorn-27330.exe
2032	Unicorn-1864.exe
3056	Unicorn-64641.exe
2756	Unicorn-20314.exe
2540	Unicorn-7547.exe
2932	Unicorn-23137.exe
1156	Unicorn-13822.exe
2740	Unicorn-39089.exe
1920	Unicorn-111.exe
2280	Unicorn-36313.exe
1148	Unicorn-65456.exe
1984	Unicorn-52457.exe
2700	Unicorn-27496.exe
2952	Unicorn-27761.exe
1108	Unicorn-48181.exe
792	Unicorn-17407.exe
1412	Unicorn-2362.exe
2408	Unicorn-16661.exe
2312	Unicorn-61585.exe
1876	Unicorn-63431.exe
892	Unicorn-15015.exe
904	Unicorn-15015.exe
864	Unicorn-46986.exe
1624	Unicorn-20252.exe
2460	Unicorn-53479.exe
1280	Unicorn-11434.exe
1648	Unicorn-38294.exe
1328	Unicorn-49691.exe

Loads dropped DLL 64 IoCs

pid	Process
2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe
2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe
2568	Unicorn-9576.exe
2568	Unicorn-9576.exe
2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe
2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe
3036	Unicorn-35834.exe
3036	Unicorn-35834.exe
2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe
2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe
2568	Unicorn-9576.exe
2568	Unicorn-9576.exe
2920	Unicorn-23028.exe
2920	Unicorn-23028.exe
3016	Unicorn-8511.exe
3016	Unicorn-8511.exe
2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe
2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe
2892	Unicorn-18726.exe
2892	Unicorn-18726.exe
2784	Unicorn-27448.exe
2920	Unicorn-23028.exe
2784	Unicorn-27448.exe
2920	Unicorn-23028.exe
2568	Unicorn-9576.exe
2568	Unicorn-9576.exe
2964	Unicorn-47506.exe
2964	Unicorn-47506.exe
3036	Unicorn-35834.exe
3036	Unicorn-35834.exe
1632	Unicorn-40381.exe
1632	Unicorn-40381.exe
3016	Unicorn-8511.exe
3016	Unicorn-8511.exe
2456	Unicorn-4511.exe
2456	Unicorn-4511.exe
2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe
2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe
1956	Unicorn-55631.exe
1956	Unicorn-55631.exe
2568	Unicorn-9576.exe
2568	Unicorn-9576.exe
2448	Unicorn-9078.exe
2448	Unicorn-9078.exe
1948	Unicorn-53593.exe
1948	Unicorn-53593.exe
3036	Unicorn-35834.exe
3036	Unicorn-35834.exe
2784	Unicorn-27448.exe
1856	Unicorn-12752.exe
2784	Unicorn-27448.exe
1856	Unicorn-12752.exe
2892	Unicorn-18726.exe
2892	Unicorn-18726.exe
2480	Unicorn-8476.exe
1564	Unicorn-33727.exe
2480	Unicorn-8476.exe
1564	Unicorn-33727.exe
2964	Unicorn-47506.exe
2964	Unicorn-47506.exe
2920	Unicorn-23028.exe
2920	Unicorn-23028.exe
2436	Unicorn-6722.exe
2436	Unicorn-6722.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60879.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe
2568	Unicorn-9576.exe
2920	Unicorn-23028.exe
3036	Unicorn-35834.exe
3016	Unicorn-8511.exe
2964	Unicorn-47506.exe
2892	Unicorn-18726.exe
2784	Unicorn-27448.exe
1632	Unicorn-40381.exe
2456	Unicorn-4511.exe
1856	Unicorn-12752.exe
1956	Unicorn-55631.exe
1948	Unicorn-53593.exe
2448	Unicorn-9078.exe
1564	Unicorn-33727.exe
2480	Unicorn-8476.exe
1768	Unicorn-14335.exe
2436	Unicorn-6722.exe
1260	Unicorn-63152.exe
2632	Unicorn-44985.exe
2200	Unicorn-34071.exe
2108	Unicorn-47402.exe
1348	Unicorn-51751.exe
1208	Unicorn-18887.exe
1356	Unicorn-12756.exe
2664	Unicorn-39115.exe
2600	Unicorn-55643.exe
1932	Unicorn-31693.exe
816	Unicorn-5736.exe
1436	Unicorn-26863.exe
456	Unicorn-11081.exe
2580	Unicorn-15387.exe
1568	Unicorn-26370.exe
2012	Unicorn-21583.exe
1500	Unicorn-27330.exe
2396	Unicorn-60941.exe
2548	Unicorn-64470.exe
2880	Unicorn-15269.exe
2032	Unicorn-1864.exe
3056	Unicorn-64641.exe
2540	Unicorn-7547.exe
2756	Unicorn-20314.exe
2932	Unicorn-23137.exe
1156	Unicorn-13822.exe
2740	Unicorn-39089.exe
1920	Unicorn-111.exe
1148	Unicorn-65456.exe
2700	Unicorn-27496.exe
2280	Unicorn-36313.exe
1984	Unicorn-52457.exe
2952	Unicorn-27761.exe
1108	Unicorn-48181.exe
792	Unicorn-17407.exe
2408	Unicorn-16661.exe
1412	Unicorn-2362.exe
2312	Unicorn-61585.exe
1876	Unicorn-63431.exe
904	Unicorn-15015.exe
1624	Unicorn-20252.exe
864	Unicorn-46986.exe
2460	Unicorn-53479.exe
1280	Unicorn-11434.exe
1648	Unicorn-38294.exe
1328	Unicorn-49691.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2568	2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe	30
PID 2524 wrote to memory of 2568	2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe	30
PID 2524 wrote to memory of 2568	2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe	30
PID 2524 wrote to memory of 2568	2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe	30
PID 2568 wrote to memory of 2920	2568	Unicorn-9576.exe	31
PID 2568 wrote to memory of 2920	2568	Unicorn-9576.exe	31
PID 2568 wrote to memory of 2920	2568	Unicorn-9576.exe	31
PID 2568 wrote to memory of 2920	2568	Unicorn-9576.exe	31
PID 2524 wrote to memory of 3036	2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe	32
PID 2524 wrote to memory of 3036	2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe	32
PID 2524 wrote to memory of 3036	2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe	32
PID 2524 wrote to memory of 3036	2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe	32
PID 3036 wrote to memory of 2964	3036	Unicorn-35834.exe	33
PID 3036 wrote to memory of 2964	3036	Unicorn-35834.exe	33
PID 3036 wrote to memory of 2964	3036	Unicorn-35834.exe	33
PID 3036 wrote to memory of 2964	3036	Unicorn-35834.exe	33
PID 2524 wrote to memory of 3016	2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe	34
PID 2524 wrote to memory of 3016	2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe	34
PID 2524 wrote to memory of 3016	2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe	34
PID 2524 wrote to memory of 3016	2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe	34
PID 2568 wrote to memory of 2784	2568	Unicorn-9576.exe	35
PID 2568 wrote to memory of 2784	2568	Unicorn-9576.exe	35
PID 2568 wrote to memory of 2784	2568	Unicorn-9576.exe	35
PID 2568 wrote to memory of 2784	2568	Unicorn-9576.exe	35
PID 2920 wrote to memory of 2892	2920	Unicorn-23028.exe	36
PID 2920 wrote to memory of 2892	2920	Unicorn-23028.exe	36
PID 2920 wrote to memory of 2892	2920	Unicorn-23028.exe	36
PID 2920 wrote to memory of 2892	2920	Unicorn-23028.exe	36
PID 3016 wrote to memory of 1632	3016	Unicorn-8511.exe	37
PID 3016 wrote to memory of 1632	3016	Unicorn-8511.exe	37
PID 3016 wrote to memory of 1632	3016	Unicorn-8511.exe	37
PID 3016 wrote to memory of 1632	3016	Unicorn-8511.exe	37
PID 2524 wrote to memory of 2456	2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe	38
PID 2524 wrote to memory of 2456	2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe	38
PID 2524 wrote to memory of 2456	2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe	38
PID 2524 wrote to memory of 2456	2524	db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe	38
PID 2892 wrote to memory of 1856	2892	Unicorn-18726.exe	39
PID 2892 wrote to memory of 1856	2892	Unicorn-18726.exe	39
PID 2892 wrote to memory of 1856	2892	Unicorn-18726.exe	39
PID 2892 wrote to memory of 1856	2892	Unicorn-18726.exe	39
PID 2784 wrote to memory of 1948	2784	Unicorn-27448.exe	40
PID 2784 wrote to memory of 1948	2784	Unicorn-27448.exe	40
PID 2784 wrote to memory of 1948	2784	Unicorn-27448.exe	40
PID 2784 wrote to memory of 1948	2784	Unicorn-27448.exe	40
PID 2920 wrote to memory of 1564	2920	Unicorn-23028.exe	41
PID 2920 wrote to memory of 1564	2920	Unicorn-23028.exe	41
PID 2920 wrote to memory of 1564	2920	Unicorn-23028.exe	41
PID 2920 wrote to memory of 1564	2920	Unicorn-23028.exe	41
PID 2568 wrote to memory of 1956	2568	Unicorn-9576.exe	42
PID 2568 wrote to memory of 1956	2568	Unicorn-9576.exe	42
PID 2568 wrote to memory of 1956	2568	Unicorn-9576.exe	42
PID 2568 wrote to memory of 1956	2568	Unicorn-9576.exe	42
PID 2964 wrote to memory of 2480	2964	Unicorn-47506.exe	43
PID 2964 wrote to memory of 2480	2964	Unicorn-47506.exe	43
PID 2964 wrote to memory of 2480	2964	Unicorn-47506.exe	43
PID 2964 wrote to memory of 2480	2964	Unicorn-47506.exe	43
PID 3036 wrote to memory of 2448	3036	Unicorn-35834.exe	44
PID 3036 wrote to memory of 2448	3036	Unicorn-35834.exe	44
PID 3036 wrote to memory of 2448	3036	Unicorn-35834.exe	44
PID 3036 wrote to memory of 2448	3036	Unicorn-35834.exe	44
PID 1632 wrote to memory of 1768	1632	Unicorn-40381.exe	45
PID 1632 wrote to memory of 1768	1632	Unicorn-40381.exe	45
PID 1632 wrote to memory of 1768	1632	Unicorn-40381.exe	45
PID 1632 wrote to memory of 1768	1632	Unicorn-40381.exe	45

C:\Users\Admin\AppData\Local\Temp\db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe
"C:\Users\Admin\AppData\Local\Temp\db2e3ce44f4c6d04fdca400010271e1be3f965b4fc2e7e6e32687cc03b4f1153.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9576.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9576.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23028.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18726.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12752.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55643.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27761.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44422.exe
        8⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25397.exe
        8⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57181.exe
        8⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        7⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27554.exe
        7⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
        7⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51786.exe
        7⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17407.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40711.exe
        7⤵
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13819.exe
        7⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
        7⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
        7⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
        7⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59954.exe
        7⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34580.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33420.exe
        6⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62077.exe
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16873.exe
        6⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2777.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20727.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11081.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63622.exe
        7⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8500.exe
        7⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19677.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53083.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
        7⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9985.exe
        7⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56092.exe
        6⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55676.exe
        6⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16990.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60754.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45648.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47411.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3561.exe
        6⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20845.exe
        6⤵
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27554.exe
        6⤵
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
        6⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51399.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43810.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe
        5⤵
        
        PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65128.exe
        5⤵
        
        PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57327.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
        5⤵
        
        PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33727.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20252.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34168.exe
        7⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12678.exe
        7⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46230.exe
        7⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39693.exe
        7⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21852.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40326.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61993.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        6⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29451.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30571.exe
        6⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6323.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31992.exe
        6⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35588.exe
        5⤵
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52736.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11616.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31014.exe
        5⤵
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        5⤵
        Executes dropped EXE
        
        PID:892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2005.exe
        5⤵
        
        PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11681.exe
        5⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54123.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11434.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1459.exe
      4⤵
      PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29729.exe
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27709.exe
      4⤵
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23993.exe
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41598.exe
      4⤵
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33396.exe
      4⤵
      PID:3712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27448.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18887.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36313.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3965.exe
        7⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34058.exe
        7⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5197.exe
        7⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39693.exe
        7⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20845.exe
        6⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27554.exe
        6⤵
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10753.exe
        6⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65456.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51536.exe
        6⤵
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13819.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10753.exe
        6⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34580.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33420.exe
        5⤵
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45747.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17068.exe
        5⤵
        
        PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        5⤵
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31693.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16661.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45947.exe
        6⤵
        
        PID:384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13819.exe
        6⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64877.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2397.exe
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe
        6⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30705.exe
        5⤵
        
        PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40575.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7125.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10753.exe
        5⤵
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58243.exe
        5⤵
        
        PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        5⤵
        
        PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45648.exe
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2102.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32149.exe
        5⤵
        
        PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29857.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19045.exe
        5⤵
        
        PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17385.exe
      4⤵
      PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
      4⤵
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61092.exe
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exe
      4⤵
      PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7717.exe
      4⤵
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23469.exe
      4⤵
      PID:6092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55631.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34071.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        6⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39009.exe
        7⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25412.exe
        7⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24721.exe
        7⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12050.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
        7⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        7⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe
        7⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55708.exe
        6⤵
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10559.exe
        6⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22419.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3385.exe
        6⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45648.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53991.exe
        6⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6172.exe
        5⤵
        
        PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32437.exe
        5⤵
        
        PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        5⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19717.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55579.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60929.exe
        5⤵
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7547.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58243.exe
        5⤵
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47264.exe
        6⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27086.exe
        6⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18894.exe
        5⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4681.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41507.exe
        5⤵
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7408.exe
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23856.exe
        5⤵
        
        PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-172.exe
      4⤵
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
        5⤵
        
        PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41940.exe
        5⤵
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11125.exe
        5⤵
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3882.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25092.exe
        5⤵
        
        PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19091.exe
      4⤵
      PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52876.exe
      4⤵
      PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
      4⤵
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53116.exe
      4⤵
      PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
      4⤵
      PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52856.exe
      4⤵
      PID:4368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23137.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49881.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64984.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6153.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57426.exe
        5⤵
        
        PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20845.exe
      4⤵
      PID:644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27554.exe
      4⤵
      PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
      4⤵
      PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2198.exe
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43810.exe
      4⤵
      PID:4264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13822.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62977.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18150.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21852.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe
      4⤵
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38765.exe
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8776.exe
      4⤵
      PID:2120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48537.exe
    3⤵
    PID:704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40711.exe
      4⤵
      PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13819.exe
      4⤵
      PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
      4⤵
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
      4⤵
      PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10753.exe
      4⤵
      PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32311.exe
    3⤵
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3754.exe
    3⤵
    PID:2476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35741.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32009.exe
    3⤵
    PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20365.exe
    3⤵
    PID:4716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23089.exe
    3⤵
    PID:5296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35834.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35834.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47506.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8476.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26863.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35501.exe
        7⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
        7⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32313.exe
        7⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52524.exe
        7⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7242.exe
        7⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6669.exe
        7⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35863.exe
        6⤵
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51400.exe
        6⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30587.exe
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52586.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45648.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53991.exe
        6⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53479.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38760.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48017.exe
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22845.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55656.exe
        6⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6791.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28681.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14709.exe
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39808.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
        5⤵
        
        PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5736.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61585.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21762.exe
        6⤵
        
        PID:436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57618.exe
        6⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3450.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65527.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62184.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62040.exe
        6⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48225.exe
        5⤵
        
        PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        5⤵
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45933.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53054.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21728.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57523.exe
        5⤵
        
        PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46986.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40711.exe
        5⤵
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61401.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45217.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56186.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2326.exe
        5⤵
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40446.exe
      4⤵
      PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24754.exe
      4⤵
      PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45541.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45524.exe
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63078.exe
      4⤵
      PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24920.exe
      4⤵
      PID:5156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9078.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51751.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39089.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56061.exe
        6⤵
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49065.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18921.exe
        6⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29825.exe
        5⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24718.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34281.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16979.exe
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3937.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19626.exe
        6⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35588.exe
        5⤵
        
        PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27178.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28458.exe
        5⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19071.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26171.exe
        5⤵
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-111.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61401.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60088.exe
        5⤵
        
        PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62714.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34048.exe
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        5⤵
        
        PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34580.exe
      4⤵
      PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33420.exe
      4⤵
      PID:524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6943.exe
      4⤵
      PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60879.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61793.exe
      4⤵
      PID:5388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12756.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52457.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21433.exe
        5⤵
        
        PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51142.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47794.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6978.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59616.exe
        5⤵
        
        PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33097.exe
      4⤵
      PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27554.exe
      4⤵
      PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
      4⤵
      PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
      4⤵
      PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6669.exe
      4⤵
      PID:5380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27496.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32629.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61553.exe
      4⤵
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24473.exe
      4⤵
      PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
      4⤵
      PID:5628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31780.exe
    3⤵
    PID:2840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4135.exe
    3⤵
    PID:3116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62607.exe
    3⤵
    PID:3292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1384.exe
    3⤵
    PID:5168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40381.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27330.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1341.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57618.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18387.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16873.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54992.exe
        6⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe
        6⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19636.exe
        5⤵
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        5⤵
        
        PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1852.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45524.exe
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        5⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63028.exe
        5⤵
        
        PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64641.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57475.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10726.exe
        5⤵
        
        PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8765.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24473.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2326.exe
        5⤵
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55237.exe
      4⤵
      PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
        5⤵
        
        PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38495.exe
      4⤵
      PID:548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35823.exe
      4⤵
      PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32765.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42037.exe
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48059.exe
      4⤵
      PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58827.exe
      4⤵
      PID:5672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6722.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26370.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe
        5⤵
        
        PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61578.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50314.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        5⤵
        
        PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
      4⤵
      PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55676.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63997.exe
      4⤵
      PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16873.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54992.exe
      4⤵
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe
      4⤵
      PID:5548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21583.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44795.exe
      4⤵
      PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9735.exe
      4⤵
      PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
      4⤵
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
      4⤵
      PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10753.exe
      4⤵
      PID:5280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34935.exe
    3⤵
    PID:804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
    3⤵
    PID:2356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28245.exe
    3⤵
    PID:3944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
    3⤵
    PID:3624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
    3⤵
    PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20545.exe
    3⤵
    PID:4272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2426.exe
    3⤵
    PID:5124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4511.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4511.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63152.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64470.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18890.exe
        5⤵
        
        PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53534.exe
        5⤵
        
        PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54598.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65414.exe
        5⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23336.exe
      4⤵
      PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62200.exe
      4⤵
      PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
      4⤵
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52387.exe
      4⤵
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
      4⤵
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
      4⤵
      PID:4344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9426.exe
      4⤵
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5577.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48405.exe
        5⤵
        
        PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18894.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16990.exe
      4⤵
      PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60754.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45648.exe
      4⤵
      PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45823.exe
      4⤵
      PID:4936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23524.exe
    3⤵
    PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9469.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe
      4⤵
      PID:5028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3016.exe
    3⤵
    PID:1572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49651.exe
    3⤵
    PID:3164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57392.exe
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52856.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52856.exe
    3⤵
    PID:472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15269.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7239.exe
      4⤵
      PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59662.exe
      4⤵
      PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5312.exe
      4⤵
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
      4⤵
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49058.exe
      4⤵
      PID:6128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20845.exe
    3⤵
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27554.exe
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
    3⤵
    PID:3352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
    3⤵
    PID:4180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
    3⤵
    PID:4412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6669.exe
    3⤵
    PID:5312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1864.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1864.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40711.exe
    3⤵
    PID:2628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13819.exe
    3⤵
    PID:2400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64877.exe
    3⤵
    PID:3416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8175.exe
    3⤵
    PID:4692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7242.exe
    3⤵
    PID:4524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20156.exe
    3⤵
    PID:5644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32311.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32311.exe
  2⤵
  PID:2500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3754.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3754.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35741.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35741.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18063.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18063.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36661.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36661.exe
  2⤵
  PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-21728.exe

Filesize
468KB

MD5
dbe29d417e893edbc9f10a527e290ac6

SHA1
e8569f314f5e4024f7bde88c3f76baf4153bc132

SHA256
b40bd9ffb6f0919f2daa7c03a5e6065c8a70ec1a2a081dbd2613c41f7550cf42

SHA512
b73a3b762a23cc6cd05dad35c6a1cb87a3d6fbf27af3ab49a3f78af169bb80153d971b0b260ca195d531ed63a54a5138a03066b91b97524eadc904c4436e4aa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55631.exe

Filesize
468KB

MD5
bf3c12587596d6f2c6473bbd94e8e098

SHA1
0d39e87ab3c118c7a662adaaca1eb467f07d8b13

SHA256
7a155f0e2157c3ea943fb82bb49946f5a80b750f4f44a460b2f9373999b032f7

SHA512
5dcbfdc0836aab0c6ab9d2f137f887d739979030ead675cce0a983dafa15ec48fb0f02757739a4560b193c8de3494d9f745dfbb321018e174524c9da94d20f7b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12752.exe

Filesize
468KB

MD5
0d78bdcbee133c88d7fe51d0515ef079

SHA1
08ff39579dfa40d76ed7690ea2e142680fe7f87d

SHA256
f003bfbf858c5156ed98313ab0b90b064dcbfb053d4ff90e5d2839d3ef1bb0f3

SHA512
89041b23d6c3d8106d51509b9b852ef589b9724a426c4294a079d1d727e65b0dff0f59964e0b5e74830d917f902aa2a3ef3e52cdfff55a8ccf325d8203bf5f93

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe

Filesize
468KB

MD5
54c5780d4267713d97f5bae207b467c3

SHA1
63c61c89078ac2d4539e75d5a771c5e920e8cc58

SHA256
5710b0d6b159eb276d6db7fc0776a79b0b12f9f88aa8277b2c7608e57cd74f4f

SHA512
390bafd288cb342d543fc509d199f277d7d3d42e33bc4285bea0ec0dae514223c6dad24464b71c5ee23de37271a671d05461c755849e634dde15ef2192f675cb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18726.exe

Filesize
468KB

MD5
c93368acfcb35583801ad2003fa63dc5

SHA1
8f3f211af90cb064dac0ef80c1b08c864922eda0

SHA256
45909bee38e44b9a0f10384187fd9f1b190ae455f4bf4b0a58f8489e42072bc2

SHA512
b16a08960f2145530f624bfece68eb2ad2f3b537fbb0897b5722707b172708597efeffc7ae82fba012cb7d1c2dda4a9fc31b94aa87948acb028bedce31b1eead

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23028.exe

Filesize
468KB

MD5
978009516bf62e9035ee78ae767d6a99

SHA1
2635d37beb6c5a2a2789d447551933288da56b74

SHA256
b6e11ed2769874865c0e3194e5f5e720afb547243dcfd9564b7ddfcc22a1f90a

SHA512
b37efbafa3cd5f6196dc63d18b50c6aff3bed5fadcbb98ac2051e99819ab5eed38b9e8ed12b748cf15c1c52457ab9767d3405f5d4c75fd4e349f3aa21242e5d1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27448.exe

Filesize
468KB

MD5
94f3609c24fb0f9dce313714de053e52

SHA1
5c1e28a4f6c285da19c594a4f102527ee9d10629

SHA256
ee8211b4c9c5effaea1c6dea0ec0bf612e3a145ae08ff595605e21749fa2db0b

SHA512
5c337acc319e97529e1fc4daa4aa348a570dafd00dc9eb8e8b5e10cc7f9ba49ef3c0158ae49e560e3af76bc4b020757544c198d58a9d538eda0d0c2622c3c1b3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33727.exe

Filesize
468KB

MD5
d1eaae3d0b174ff4109d1eee8c5289c6

SHA1
61610a35c58eda9d53da58149e75d8eea0b73d15

SHA256
47e4e6f15d69293faec59d2e3e33774d2bd28d642f9c771f10a5ae441c31a500

SHA512
4f47c80b85d484c92aa299809c9581bf14c2f19f4767fff34d67bb74993f24dc8b3391a57660ee191193bdf5fdeafff91546d85f25ac1de79a7fc0e24ea1dfae

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35834.exe

Filesize
468KB

MD5
9b8ef80941c28b44166c9fda562167a4

SHA1
b74c4433962835596b02b75d47e2204d463e4a38

SHA256
b4542bca961661becbaf37f7abfd02557ca27f3297094b0d487141bb43f55b6b

SHA512
339fc0aaf4086fcceb670463101532b64faa7f052e394dcc4f4b9d915337fc63e652a10cab52c90a1d26639e29ff4736873e8d50417852caa822d5b07835b39f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40381.exe

Filesize
468KB

MD5
f37b68717c2bdeea0b1ab6c8bdd4d1d5

SHA1
3405d099cf9f7d128bc50866f9a288f37f202f0d

SHA256
d04559b6c360dbd5a857111e60482dc424a7dd9bc438a706399d5886ec0c5dc3

SHA512
cb745d22690500a591d9c92d754f9c9f2332b180782c2c161de760cfa1f8d282227d37fd6244a0df5771280fd46c3e681f53e1c6e997bcd77f4d24ea3ed9da6d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe

Filesize
468KB

MD5
8be144d8c69e98f70fa131c971e4f971

SHA1
145f928e6a8e215c53439f70d08d663b191570d4

SHA256
081cdeeb1d5322c09f5a96853585113d308590061bed8e622cc9a5b8c28281d2

SHA512
f57226de404383b9c9438ef84d0b881b9d52236b496e10e9ede122d9b904f6bd157f9ecde96dbc8825a8949dc3bd9e23e693dc3b530a8373fd4e714fe6b83e50

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4511.exe

Filesize
468KB

MD5
8be8aac3bbf257bc5673da3e85a22e4a

SHA1
035b45a4af8a3790d2c6d19517885ef1dc85320f

SHA256
a04c81edeb53038ab6b32d412b3f10ad5bdfaff75a48ca0df10fe173900086b4

SHA512
6a37f3e036eb17e022011f10e4fd6f6bbe200c7be9c441ec5d02086190994058f77b277e54700ab3d52d605e2dcb1ee8fe59324a734e966484996e34d787a708

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47506.exe

Filesize
468KB

MD5
12db75f557578004cee1f576e7246eff

SHA1
350db741f6608695f4a28fa7cb3fdb1a0a5261f7

SHA256
89fd2eadd724cfafbbc2c74778b93f5e56ebe89643513ec952d10648be706405

SHA512
9786299481574f60fc28b0e83d05108098a7bb48bd771bc20fe6a63b0faa97a40f58798f757cd264d38c86c078414159d20149bbd4ea64668d6b9401ebc53e8b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe

Filesize
468KB

MD5
88c8bfc5c2e128f6954309273c376546

SHA1
65116624c593b2d67145312989509020bb5b7c1d

SHA256
74a7219c7001b3a41efa3ca730efd4ede3cdf6b27d12a1ac3e91f12ad93d0e06

SHA512
d6b20aee19d1e6aa53c36aa72ad04ac2fb772b0a08033ebeacd27cccb06f6053d83219dec2d245ec9752fe98b190ad2be6554775a33821949c29005733570ef8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63152.exe

Filesize
468KB

MD5
3f2b31b405da2c6c31d7623bac28a3ac

SHA1
332b239a4d7c68e70bd63205d2ab2a92359f96c9

SHA256
ed300994b68e3d7435c6a251436e73379dc734008f49f5806db740f2b2ce1c15

SHA512
21ea38a55591f09935418ee03c526e12d342bff7eae063fbd071ad943ceaca4cebd18ec5eb55ff9340868c1cac60e43eaa6b5defcaa027104e98d826a8c1f842

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6722.exe

Filesize
468KB

MD5
ece1565864ce8e7c2f1a77d0c1bd6cbe

SHA1
9b18043673f0d382423cf60a621ca59fae90bea9

SHA256
65ea10ea35e6b31160b1e156f2b6fb9562fe69864898fe492b8d5970277084c3

SHA512
d80c6e6ed54adf6c01184538497aadba9ea831c0eb11f128c80bbceac4ba31e258facf8758aed097cf9acfd97bcb33861d51f845fb72932b214a354dff979e6f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8476.exe

Filesize
468KB

MD5
4f5a4c0209fd1b716801e996f7983fe5

SHA1
ab05b75b554ce6516c8095d1367d51df4506a312

SHA256
f17f87120c045c361053f24d4fe44a8dd4dbb5dd4523902399c82c530b7923c6

SHA512
ca886e1395f8100dab6ac414ebcc2f18f21065923a907f89041ed146b6b78702b2aef2f6c4652fd66a36b7fbec244d103042d7b69777464a5c12bdb225964569

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe

Filesize
468KB

MD5
18be974da9d8bd3984f5cbf6b2a1f2c5

SHA1
16b0fe47d0cb4f0c4a4c4b356deb9518492f89c4

SHA256
81a2aff41468c677725a8dd162e45df9b6c64ba6ccc4d8783697cf860d54cdef

SHA512
357082ad7182a941f2301e527229f1b7ada8b0acbd444f56fc56c127609bf0fdbd2a4e770dc794c443c2fd6710e0dfb0573fe410914d9103788eef7b1f07c657

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9078.exe

Filesize
468KB

MD5
b04e39c5884c682be04887d8b559815e

SHA1
a3ed37702f0bd08a3b6ffd6cc86e271acecef4c3

SHA256
5f42543afd4edd2e513543af994e9823d56102fe21eea6e42c3871a801d03807

SHA512
0b7afad83bb1befbdec428b29982f187ed9ef55486c4cab171b12821618b4e437b53238967f9210b2b824454fce4bf653c268366c194e1a6888452ba02430f4a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9576.exe

Filesize
468KB

MD5
43f7e98ff90b7040f78ad6cc9f515686

SHA1
ff0f929cf5764a89ae5bd0753c81e44cc5a3afc1

SHA256
2a12d81dad179cc0c33d850846bd501feec365ee94b2b633108bb0ac3543aa28

SHA512
fd8e45c255b54b33b721c53ceb4abf03842936a637bbe7164544111c5dd712b068c5618b314fd90f20531d38e9d4ce6597b0070de59bbdc98c333beb3d86a728

Download Submit