4bb74ee1b018d0312f8edbe2f095e69606022948d10640f63b7972f333131bf0

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c5796f813b7213e9c391009fb4327f0N.exe
Size

468KB
MD5

5c5796f813b7213e9c391009fb4327f0
SHA1

b1ec2c2c756bc124ef49e25c665e00764f4652ea
SHA256

4bb74ee1b018d0312f8edbe2f095e69606022948d10640f63b7972f333131bf0
SHA512

fecf226be509bac698dd4f06df0364779ba923fb93ab2f24a29d116aee94ab51a3909d00d0f077ce0651928f66747fa52653ee1b9db4a088f2ac80bce963a2c8
SSDEEP

3072:Vqm+ogKxjP8R2bY9vz3ygf8/EChjjjlKPPHIvVHpd+t+DMKNQVlX:Vqvot0R2+vDygfuhpXd+4AKNQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2444	Unicorn-64677.exe
2944	Unicorn-55907.exe
2908	Unicorn-59628.exe
3008	Unicorn-26603.exe
2688	Unicorn-29233.exe
2692	Unicorn-57075.exe
2036	Unicorn-51521.exe
2412	Unicorn-64698.exe
1368	Unicorn-11667.exe
3068	Unicorn-39618.exe
2860	Unicorn-39618.exe
2200	Unicorn-39353.exe
2320	Unicorn-33487.exe
1320	Unicorn-38871.exe
2164	Unicorn-51294.exe
304	Unicorn-25524.exe
2296	Unicorn-33919.exe
560	Unicorn-62145.exe
1828	Unicorn-50941.exe
1680	Unicorn-11237.exe
1876	Unicorn-4339.exe
1844	Unicorn-27190.exe
112	Unicorn-26925.exe
2144	Unicorn-56525.exe
1796	Unicorn-19022.exe
2352	Unicorn-29800.exe
2016	Unicorn-26841.exe
1992	Unicorn-46707.exe
944	Unicorn-40577.exe
2168	Unicorn-38731.exe
2904	Unicorn-57672.exe
2316	Unicorn-27417.exe
2900	Unicorn-15295.exe
2864	Unicorn-3877.exe
2664	Unicorn-60277.exe
2460	Unicorn-31091.exe
2288	Unicorn-50957.exe
1740	Unicorn-4178.exe
2284	Unicorn-1948.exe
1240	Unicorn-55980.exe
1404	Unicorn-24372.exe
2176	Unicorn-49333.exe
1672	Unicorn-31880.exe
2324	Unicorn-17922.exe
1560	Unicorn-473.exe
1488	Unicorn-64548.exe
1656	Unicorn-64548.exe
1780	Unicorn-42386.exe
1644	Unicorn-53322.exe
2232	Unicorn-21796.exe
1592	Unicorn-21796.exe
2548	Unicorn-9823.exe
564	Unicorn-28620.exe
1776	Unicorn-50856.exe
700	Unicorn-59408.exe
2440	Unicorn-32678.exe
2784	Unicorn-34790.exe
2884	Unicorn-44804.exe
2880	Unicorn-59102.exe
2924	Unicorn-28851.exe
2188	Unicorn-28851.exe
2808	Unicorn-58526.exe
2752	Unicorn-17494.exe
2516	Unicorn-11363.exe

Loads dropped DLL 64 IoCs

pid	Process
1140	5c5796f813b7213e9c391009fb4327f0N.exe
1140	5c5796f813b7213e9c391009fb4327f0N.exe
1140	5c5796f813b7213e9c391009fb4327f0N.exe
2444	Unicorn-64677.exe
1140	5c5796f813b7213e9c391009fb4327f0N.exe
2444	Unicorn-64677.exe
2908	Unicorn-59628.exe
2908	Unicorn-59628.exe
2944	Unicorn-55907.exe
2944	Unicorn-55907.exe
2444	Unicorn-64677.exe
2444	Unicorn-64677.exe
1140	5c5796f813b7213e9c391009fb4327f0N.exe
1140	5c5796f813b7213e9c391009fb4327f0N.exe
3008	Unicorn-26603.exe
3008	Unicorn-26603.exe
2908	Unicorn-59628.exe
2908	Unicorn-59628.exe
2688	Unicorn-29233.exe
2688	Unicorn-29233.exe
2036	Unicorn-51521.exe
2036	Unicorn-51521.exe
1140	5c5796f813b7213e9c391009fb4327f0N.exe
2444	Unicorn-64677.exe
1140	5c5796f813b7213e9c391009fb4327f0N.exe
2444	Unicorn-64677.exe
2692	Unicorn-57075.exe
2692	Unicorn-57075.exe
2944	Unicorn-55907.exe
2944	Unicorn-55907.exe
2412	Unicorn-64698.exe
2412	Unicorn-64698.exe
3008	Unicorn-26603.exe
3008	Unicorn-26603.exe
3068	Unicorn-39618.exe
3068	Unicorn-39618.exe
2688	Unicorn-29233.exe
2688	Unicorn-29233.exe
1368	Unicorn-11667.exe
1368	Unicorn-11667.exe
2908	Unicorn-59628.exe
2908	Unicorn-59628.exe
2320	Unicorn-33487.exe
2320	Unicorn-33487.exe
2444	Unicorn-64677.exe
2444	Unicorn-64677.exe
2692	Unicorn-57075.exe
2692	Unicorn-57075.exe
2200	Unicorn-39353.exe
2200	Unicorn-39353.exe
1140	5c5796f813b7213e9c391009fb4327f0N.exe
2164	Unicorn-51294.exe
2036	Unicorn-51521.exe
2860	Unicorn-39618.exe
2944	Unicorn-55907.exe
1140	5c5796f813b7213e9c391009fb4327f0N.exe
2036	Unicorn-51521.exe
2164	Unicorn-51294.exe
2860	Unicorn-39618.exe
2944	Unicorn-55907.exe
304	Unicorn-25524.exe
304	Unicorn-25524.exe
2412	Unicorn-64698.exe
2412	Unicorn-64698.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24600.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1140	5c5796f813b7213e9c391009fb4327f0N.exe
2444	Unicorn-64677.exe
2944	Unicorn-55907.exe
2908	Unicorn-59628.exe
3008	Unicorn-26603.exe
2688	Unicorn-29233.exe
2036	Unicorn-51521.exe
2692	Unicorn-57075.exe
2412	Unicorn-64698.exe
1368	Unicorn-11667.exe
3068	Unicorn-39618.exe
2860	Unicorn-39618.exe
2320	Unicorn-33487.exe
2200	Unicorn-39353.exe
1320	Unicorn-38871.exe
2164	Unicorn-51294.exe
304	Unicorn-25524.exe
2296	Unicorn-33919.exe
560	Unicorn-62145.exe
1828	Unicorn-50941.exe
1680	Unicorn-11237.exe
1876	Unicorn-4339.exe
1844	Unicorn-27190.exe
2144	Unicorn-56525.exe
2016	Unicorn-26841.exe
944	Unicorn-40577.exe
2352	Unicorn-29800.exe
2168	Unicorn-38731.exe
112	Unicorn-26925.exe
1992	Unicorn-46707.exe
1796	Unicorn-19022.exe
2316	Unicorn-27417.exe
2904	Unicorn-57672.exe
2900	Unicorn-15295.exe
2864	Unicorn-3877.exe
2288	Unicorn-50957.exe
1740	Unicorn-4178.exe
1240	Unicorn-55980.exe
2460	Unicorn-31091.exe
2284	Unicorn-1948.exe
2664	Unicorn-60277.exe
1404	Unicorn-24372.exe
2176	Unicorn-49333.exe
1672	Unicorn-31880.exe
2324	Unicorn-17922.exe
1560	Unicorn-473.exe
1488	Unicorn-64548.exe
1656	Unicorn-64548.exe
1644	Unicorn-53322.exe
1592	Unicorn-21796.exe
2232	Unicorn-21796.exe
2548	Unicorn-9823.exe
1776	Unicorn-50856.exe
1780	Unicorn-42386.exe
564	Unicorn-28620.exe
700	Unicorn-59408.exe
2924	Unicorn-28851.exe
2440	Unicorn-32678.exe
3036	Unicorn-61707.exe
2784	Unicorn-34790.exe
2880	Unicorn-59102.exe
2884	Unicorn-44804.exe
2752	Unicorn-17494.exe
2188	Unicorn-28851.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2444	1140	5c5796f813b7213e9c391009fb4327f0N.exe	30
PID 1140 wrote to memory of 2444	1140	5c5796f813b7213e9c391009fb4327f0N.exe	30
PID 1140 wrote to memory of 2444	1140	5c5796f813b7213e9c391009fb4327f0N.exe	30
PID 1140 wrote to memory of 2444	1140	5c5796f813b7213e9c391009fb4327f0N.exe	30
PID 1140 wrote to memory of 2944	1140	5c5796f813b7213e9c391009fb4327f0N.exe	32
PID 1140 wrote to memory of 2944	1140	5c5796f813b7213e9c391009fb4327f0N.exe	32
PID 1140 wrote to memory of 2944	1140	5c5796f813b7213e9c391009fb4327f0N.exe	32
PID 1140 wrote to memory of 2944	1140	5c5796f813b7213e9c391009fb4327f0N.exe	32
PID 2444 wrote to memory of 2908	2444	Unicorn-64677.exe	31
PID 2444 wrote to memory of 2908	2444	Unicorn-64677.exe	31
PID 2444 wrote to memory of 2908	2444	Unicorn-64677.exe	31
PID 2444 wrote to memory of 2908	2444	Unicorn-64677.exe	31
PID 2908 wrote to memory of 3008	2908	Unicorn-59628.exe	33
PID 2908 wrote to memory of 3008	2908	Unicorn-59628.exe	33
PID 2908 wrote to memory of 3008	2908	Unicorn-59628.exe	33
PID 2908 wrote to memory of 3008	2908	Unicorn-59628.exe	33
PID 2944 wrote to memory of 2692	2944	Unicorn-55907.exe	34
PID 2944 wrote to memory of 2692	2944	Unicorn-55907.exe	34
PID 2944 wrote to memory of 2692	2944	Unicorn-55907.exe	34
PID 2944 wrote to memory of 2692	2944	Unicorn-55907.exe	34
PID 2444 wrote to memory of 2688	2444	Unicorn-64677.exe	35
PID 2444 wrote to memory of 2688	2444	Unicorn-64677.exe	35
PID 2444 wrote to memory of 2688	2444	Unicorn-64677.exe	35
PID 2444 wrote to memory of 2688	2444	Unicorn-64677.exe	35
PID 1140 wrote to memory of 2036	1140	5c5796f813b7213e9c391009fb4327f0N.exe	36
PID 1140 wrote to memory of 2036	1140	5c5796f813b7213e9c391009fb4327f0N.exe	36
PID 1140 wrote to memory of 2036	1140	5c5796f813b7213e9c391009fb4327f0N.exe	36
PID 1140 wrote to memory of 2036	1140	5c5796f813b7213e9c391009fb4327f0N.exe	36
PID 3008 wrote to memory of 2412	3008	Unicorn-26603.exe	37
PID 3008 wrote to memory of 2412	3008	Unicorn-26603.exe	37
PID 3008 wrote to memory of 2412	3008	Unicorn-26603.exe	37
PID 3008 wrote to memory of 2412	3008	Unicorn-26603.exe	37
PID 2908 wrote to memory of 1368	2908	Unicorn-59628.exe	38
PID 2908 wrote to memory of 1368	2908	Unicorn-59628.exe	38
PID 2908 wrote to memory of 1368	2908	Unicorn-59628.exe	38
PID 2908 wrote to memory of 1368	2908	Unicorn-59628.exe	38
PID 2688 wrote to memory of 3068	2688	Unicorn-29233.exe	39
PID 2688 wrote to memory of 3068	2688	Unicorn-29233.exe	39
PID 2688 wrote to memory of 3068	2688	Unicorn-29233.exe	39
PID 2688 wrote to memory of 3068	2688	Unicorn-29233.exe	39
PID 2036 wrote to memory of 2860	2036	Unicorn-51521.exe	40
PID 2036 wrote to memory of 2860	2036	Unicorn-51521.exe	40
PID 2036 wrote to memory of 2860	2036	Unicorn-51521.exe	40
PID 2036 wrote to memory of 2860	2036	Unicorn-51521.exe	40
PID 1140 wrote to memory of 2200	1140	5c5796f813b7213e9c391009fb4327f0N.exe	41
PID 1140 wrote to memory of 2200	1140	5c5796f813b7213e9c391009fb4327f0N.exe	41
PID 1140 wrote to memory of 2200	1140	5c5796f813b7213e9c391009fb4327f0N.exe	41
PID 1140 wrote to memory of 2200	1140	5c5796f813b7213e9c391009fb4327f0N.exe	41
PID 2444 wrote to memory of 2320	2444	Unicorn-64677.exe	42
PID 2444 wrote to memory of 2320	2444	Unicorn-64677.exe	42
PID 2444 wrote to memory of 2320	2444	Unicorn-64677.exe	42
PID 2444 wrote to memory of 2320	2444	Unicorn-64677.exe	42
PID 2692 wrote to memory of 1320	2692	Unicorn-57075.exe	43
PID 2692 wrote to memory of 1320	2692	Unicorn-57075.exe	43
PID 2692 wrote to memory of 1320	2692	Unicorn-57075.exe	43
PID 2692 wrote to memory of 1320	2692	Unicorn-57075.exe	43
PID 2944 wrote to memory of 2164	2944	Unicorn-55907.exe	44
PID 2944 wrote to memory of 2164	2944	Unicorn-55907.exe	44
PID 2944 wrote to memory of 2164	2944	Unicorn-55907.exe	44
PID 2944 wrote to memory of 2164	2944	Unicorn-55907.exe	44
PID 2412 wrote to memory of 304	2412	Unicorn-64698.exe	45
PID 2412 wrote to memory of 304	2412	Unicorn-64698.exe	45
PID 2412 wrote to memory of 304	2412	Unicorn-64698.exe	45
PID 2412 wrote to memory of 304	2412	Unicorn-64698.exe	45

C:\Users\Admin\AppData\Local\Temp\5c5796f813b7213e9c391009fb4327f0N.exe
"C:\Users\Admin\AppData\Local\Temp\5c5796f813b7213e9c391009fb4327f0N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59628.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26603.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64698.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59123.exe
        8⤵
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe
        9⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        9⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64481.exe
        9⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
        9⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
        9⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22760.exe
        8⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59272.exe
        9⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35037.exe
        9⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2816.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15000.exe
        9⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
        8⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39289.exe
        8⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22209.exe
        8⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23393.exe
        8⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
        7⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46859.exe
        8⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39002.exe
        8⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29718.exe
        8⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
        7⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33848.exe
        7⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14962.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26367.exe
        7⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27417.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
        8⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31430.exe
        8⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exe
        8⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3754.exe
        8⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-170.exe
        8⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        7⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        7⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14181.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        7⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        7⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28851.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7457.exe
        7⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55813.exe
        8⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
        8⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
        8⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        7⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25229.exe
        7⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21582.exe
        7⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-944.exe
        6⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        7⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6264.exe
        7⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27337.exe
        7⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
        7⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47168.exe
        7⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29020.exe
        6⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25830.exe
        6⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
        6⤵
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39625.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        6⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33919.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32611.exe
        7⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49217.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53584.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53495.exe
        7⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3949.exe
        6⤵
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64161.exe
        6⤵
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30446.exe
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4517.exe
        6⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3877.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        6⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31430.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exe
        7⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3754.exe
        7⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-170.exe
        7⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58926.exe
        6⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14181.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        6⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53788.exe
        5⤵
        
        PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
        5⤵
        
        PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43692.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62772.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58105.exe
        5⤵
        
        PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11667.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49333.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64548.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59154.exe
        8⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        8⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44650.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10370.exe
        8⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28537.exe
        8⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23253.exe
        7⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14659.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50175.exe
        7⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22600.exe
        7⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30832.exe
        7⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42386.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31820.exe
        6⤵
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51031.exe
        6⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5516.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe
        6⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-700.exe
        6⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31880.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58526.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5117.exe
        7⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe
        7⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exe
        6⤵
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44888.exe
        6⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9334.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6328.exe
        6⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe
        5⤵
        Executes dropped EXE
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44940.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36541.exe
        6⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16383.exe
        5⤵
        
        PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3051.exe
        5⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13911.exe
        5⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21582.exe
        5⤵
        
        PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4339.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21796.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        7⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        7⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64481.exe
        7⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        7⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        7⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34187.exe
        6⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
        6⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55817.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15193.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47898.exe
        6⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9823.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
        6⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60514.exe
        6⤵
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23064.exe
        6⤵
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
        6⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37586.exe
        5⤵
        
        PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39466.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52444.exe
        5⤵
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58639.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64234.exe
        5⤵
        
        PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24372.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64548.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12553.exe
        5⤵
        
        PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63336.exe
        5⤵
        
        PID:1116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9334.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22600.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6328.exe
        5⤵
        
        PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53322.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        5⤵
        
        PID:276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18085.exe
        6⤵
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21036.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62242.exe
        6⤵
        
        PID:236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4517.exe
        6⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        5⤵
        
        PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11831.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31152.exe
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30832.exe
        5⤵
        
        PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12230.exe
      4⤵
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
        5⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11422.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9656.exe
        5⤵
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6328.exe
        5⤵
        
        PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
      4⤵
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56731.exe
        5⤵
        
        PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63633.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30832.exe
        5⤵
        
        PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2680.exe
      4⤵
      PID:592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26717.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65202.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46818.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44833.exe
      4⤵
      PID:4560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29233.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39618.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62145.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60277.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20696.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45585.exe
        8⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
        8⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
        8⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe
        8⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        7⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63704.exe
        7⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
        6⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47281.exe
        7⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44884.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33160.exe
        7⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        7⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64524.exe
        6⤵
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56124.exe
        6⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64163.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26367.exe
        6⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32678.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31137.exe
        7⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        7⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8264.exe
        7⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39242.exe
        7⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47368.exe
        7⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe
        6⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1250.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18671.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47097.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6865.exe
        6⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44804.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32398.exe
        6⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19803.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33160.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53214.exe
        6⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23389.exe
        5⤵
        
        PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14018.exe
        5⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62634.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31107.exe
        5⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50871.exe
        5⤵
        
        PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50941.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50957.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21796.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18085.exe
        6⤵
        
        PID:980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        6⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8139.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50856.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2107.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
        7⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46884.exe
        7⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39112.exe
        7⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
        7⤵
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18085.exe
        6⤵
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14181.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        6⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57340.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14233.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38698.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63601.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53429.exe
        5⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14214.exe
        5⤵
        
        PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4178.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49601.exe
        6⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64130.exe
        6⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        6⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18085.exe
        5⤵
        
        PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16307.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12625.exe
      4⤵
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21049.exe
        5⤵
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        6⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28489.exe
        5⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22600.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30832.exe
        5⤵
        
        PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
      4⤵
      PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3238.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1216.exe
      4⤵
      PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21032.exe
      4⤵
      PID:5104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28620.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18085.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14181.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40811.exe
        5⤵
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59408.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31820.exe
      4⤵
      PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51031.exe
      4⤵
      PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27820.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25205.exe
      4⤵
      PID:5524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26925.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37224.exe
      4⤵
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39256.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15000.exe
        5⤵
        
        PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
      4⤵
      PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64481.exe
      4⤵
      PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39112.exe
      4⤵
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6060.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3597.exe
    3⤵
    PID:1052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18292.exe
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52974.exe
    3⤵
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48963.exe
    3⤵
    PID:4264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
    3⤵
    PID:4488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55907.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55907.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57075.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38871.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe
        6⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64557.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5686.exe
        7⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9256.exe
        7⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe
        7⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        6⤵
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44650.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10370.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28537.exe
        6⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4477.exe
        5⤵
        
        PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43493.exe
        5⤵
        
        PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49993.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23130.exe
        5⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26367.exe
        5⤵
        
        PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17922.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        6⤵
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20327.exe
        6⤵
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
        6⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57602.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
        5⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55817.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15193.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47898.exe
        5⤵
        
        PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28796.exe
        5⤵
        
        PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26422.exe
        5⤵
        
        PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32346.exe
      4⤵
      PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5265.exe
      4⤵
      PID:3180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47827.exe
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1863.exe
      4⤵
      PID:5204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51294.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51294.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46707.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5117.exe
        5⤵
        
        PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3469.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64130.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        5⤵
        
        PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55433.exe
      4⤵
      PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
      4⤵
      PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61109.exe
      4⤵
      PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4427.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6328.exe
      4⤵
      PID:4492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
      4⤵
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21880.exe
        5⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
        5⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31529.exe
        5⤵
        
        PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
      4⤵
      PID:1304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63028.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23548.exe
      4⤵
      PID:5092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15552.exe
    3⤵
    PID:2972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
    3⤵
    PID:3064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4957.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4957.exe
    3⤵
    PID:4272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1863.exe
    3⤵
    PID:4552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39618.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38731.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5117.exe
        5⤵
        
        PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3469.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47410.exe
        5⤵
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        5⤵
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55433.exe
      4⤵
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31137.exe
        5⤵
        
        PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34411.exe
        5⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64130.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        5⤵
        
        PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25390.exe
      4⤵
      PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7691.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21800.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30761.exe
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36897.exe
      4⤵
      PID:5960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26841.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59102.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45585.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58265.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
        5⤵
        
        PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58759.exe
      4⤵
      PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28930.exe
      4⤵
      PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62242.exe
      4⤵
      PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
      4⤵
      PID:2536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28851.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37686.exe
    3⤵
    PID:2604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42366.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
    3⤵
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61156.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
    3⤵
    PID:5432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39353.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39353.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19022.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59699.exe
      4⤵
      PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
      4⤵
      PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49873.exe
      4⤵
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
      4⤵
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
      4⤵
      PID:4388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
    3⤵
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
      4⤵
      PID:1832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31430.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exe
      4⤵
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3754.exe
      4⤵
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-170.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64624.exe
    3⤵
    PID:1336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60228.exe
    3⤵
    PID:3156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62344.exe
    3⤵
    PID:3840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14099.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17494.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15216.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
      4⤵
      PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
      4⤵
      PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe
      4⤵
      PID:4176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62320.exe
    3⤵
    PID:1292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
    3⤵
    PID:3844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
    3⤵
    PID:3936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
    3⤵
    PID:4600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58826.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58826.exe
  2⤵
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55031.exe
    3⤵
    PID:3876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5370.exe
    3⤵
    PID:3420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23548.exe
    3⤵
    PID:5100
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
  2⤵
  PID:936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21365.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21365.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3504
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44717.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44717.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38490.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38490.exe
  2⤵
  PID:4408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15836.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15836.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11667.exe

Filesize
468KB

MD5
e803401efc3274e861058a4ca8bf8c7f

SHA1
861f405765a8dc8363fd5d33789bb2600e23d803

SHA256
2f2bc37baea83b6e9d1c4f66645ce3590b5b5d7c04001f89d77be8779e58db19

SHA512
d469b2af2e7216a47b1f21bf1d93b272419d25a37810b1e050f6f71644b702a65c589bd8e4276509aece4d125c6613f277d141be7a411498107c78939b6aba20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11831.exe

Filesize
468KB

MD5
42671001d9210be8faee3a142cb0eca3

SHA1
4cada28fb9fa2e19a016c0818bcf994bff137c82

SHA256
0b4f57eb475ba2f52887e6c528d859aa1563eb7e96cb8d8fdbb742562c242d51

SHA512
001717f81c0c35765db8dcf3b8b1352d96cc3741fafb69b0ac56eb5fb7db91fb74607bd2b4048062def5ef94bc9ed2c678f4d37073496a956b5f67ab4c211872

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18292.exe

Filesize
468KB

MD5
31ce7e506c41d5b17dd0ffe8353ed0a2

SHA1
361f9ea7c4c65c61f7c96c17e7dd4046fc7f1d6f

SHA256
db54a0af5d57cbf9137aaf0e591a0565afab597ff0f075e920baeaae363483c4

SHA512
a508ff3444ed9e6141e8d7f65572ce0c559687387a06d985467d717246b69421f2c0cbe048f96f9b524ea43a51dfcdd45feb1b66a5b3b6c9bd730eb687779d76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29233.exe

Filesize
468KB

MD5
ef7c1286b535e7a236f286d1d7fbf87b

SHA1
4f21fb853c248148f2b9f79849f02edf7b0b7480

SHA256
07bb6553a04b95a0a302639c2a0e8c837426f2a54fa681ec431f259406664863

SHA512
411fb9fc1d9a2c27907bbec64a1240958b032bdd84c520149024315d403f5529a7a827ecf54f60dd0a7bdb072946beafa0506dd2a9e4fd47d23e46d29b3dd4ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39353.exe

Filesize
468KB

MD5
26b927ce93936775fdae70f32a4e2e4b

SHA1
041cfcf379cddd242b1cda882e1181bcbfa154d8

SHA256
c386b5ba7887840a98235ca0c4bac5474a708779523de746de025b6f64f50626

SHA512
22ca7f655515cacb0cac5126d0db2a7a8c0ff051f094398e6c434c5cc9044e699da874db3ecbab2a97eafa5d6903c5a8ece74de2d282a33a8d6aaf8863690522

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39618.exe

Filesize
468KB

MD5
3726470c75e3692d9c01d9a1bc5e5e61

SHA1
07f6fce88db8b7bfb172b1ad6a21207ec1d43c53

SHA256
9d3518da173640189452e2e48e6cb29ab379fb9525cda98df10e04f27f924547

SHA512
dc41b50d23ca1b57cf9cf502146e9204d5ebebb0444d0ab55c4be090163be2286f203a21de9bc592b10c785b32f482d4b95cd1bd72436b9a347b5c873f66d666

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe

Filesize
468KB

MD5
d48d43b6f0a909377abbc3414c012451

SHA1
aa9e61bdd335a88dbb844e2880765f62859107c2

SHA256
fa2090dd13c2f9091b482d5a3140ac155d0e7cbe239ed5e6239174d8c0acf9dd

SHA512
7274b053d7a18341bd604d1ef9c3680cec4a94f4b3ad2efab05426fa5b654ad860e773b8ffd4f5b0affaa7a4126846495b79bbc1aeb1e2c0f81f55babb535d26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57075.exe

Filesize
468KB

MD5
93370f214170b61082a7f8827ee4bb20

SHA1
e02188eee21984354c72b6c902d53a308c7ab5ae

SHA256
05f79a631f17869bec3b7487ec14c653fb093b917fba0f96ca24a32361e8a5be

SHA512
587b592f3a24b3cc64d7504eb44bef6cfcd2126a9153eb941eea126a662ff00561b644ef61b1ec20d2fb5c030f2f66f0e6c0b7ffbdf3742f1ee40e207de4d9cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59628.exe

Filesize
468KB

MD5
c203f9e796f0d7d78bb90c481a1ba064

SHA1
052a2a5fdacd03faa36c3a0d172e4c9b0a316116

SHA256
ae1fcf286116b98bac06d6c621e48fb3912caaa4a0d956ca994f300de7829814

SHA512
d2e6293299485ec2ce495bd9546f8f76b52def607263a429591dc9608a71623199b9b83d6dcb4da8489e6e344b2e60b5a7076078ce9a60f20373df948a7a6b8c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe

Filesize
468KB

MD5
d0f77805974df1b3ec3b88534303de90

SHA1
10329c13ced8013351a9c730a4f019c2357221da

SHA256
701dd7225660deb797f4bef1a4bbee3138135f89c3f8c689c08704abe4a7c75a

SHA512
8d7ffa34e0281320ffa263cc5e8ca1ec3760cfea4ce37c61e151d3327c08e93b810a678db091bc1b2a5a64e2f98c665e79d6c8035420391f61ec2e6a860fce10

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26603.exe

Filesize
468KB

MD5
646b396475acf5ca4a628917e885f2da

SHA1
aff2f171a5745b319ade77278b4bbb0655339e53

SHA256
d2c2ed02942571ff097d87bd35a660342ece14f0f427d7d3208ef4c08260b526

SHA512
9a8071e958baf3aca0eda11ac2c6442fad15c02b7e139c025fd147c5c8f2b473e1b26a9664fb64a5aa3ddb3d0150a8a071aef066fdcaf24190162a3a5c5db62a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe

Filesize
468KB

MD5
0e124d39fa903c890d45ca00eabc538f

SHA1
45637e9026370bcd6de12b641795df8b79cebf6e

SHA256
32b34d28059f48b4d281ca7c78143e00cac66ea484318be35e24a5bd4014e5ca

SHA512
174ac68ff629a1a87f50fb4cb96d26bb0f54ece5d7f81c3a96bf4f808dd454630fa84ab11ea485d815bcc4913217f21892de271efb58cdb8b2859a7e1cd3f56f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33919.exe

Filesize
468KB

MD5
3bbab3c5ace4bf0b7eaa62d3f3cf6390

SHA1
57e57ffe5c8fe017e15ae3e2b89dc479d37ea665

SHA256
1986a08188cdce818b430bccf2482783776c1d0449501e41c9f70eba30321155

SHA512
86c1d7715912c5e24d40b1ba918bf328a0636a2d66cb17b923eb12cde07c6ff49798bdb3d474d281ab896a1f3de05c7d50596c2d275ac9d163b8cf51b964abf9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38871.exe

Filesize
468KB

MD5
99314c53b3606f2d2d43433391d0daee

SHA1
5057689e66ba195881a08f463c58855dd6b9b477

SHA256
3522fe67fb1b7f82cd63dd558bc392aa82b21e9ab655287c301c5b7af8c650d6

SHA512
5b6a9ae1d937f7cff8970d349391a0d8fe60d3ddfbaa58e06a633550ffac76604eaf654b45f3b02fd366ce984cf6e06f3faeeb473b1107b5e27ef88ba22931d2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50941.exe

Filesize
468KB

MD5
02aa858d956db24d126284019b298143

SHA1
51e0b6382705de8f961f14481a9c00a7a3a6481f

SHA256
ffcc71fcc81295e0f14e566c1e57e22fcb30c4982d6b272edbb106cb3d8772de

SHA512
c33e940071dc9d94cc4d870fe9b4dfad93b3b5800ed7ec07ed39e5712ccf54988e2aca882f6b3565084be0e28c2b978aa3585d8582d051e1f8d1cd6b51babe41

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51294.exe

Filesize
468KB

MD5
26947743013fd17e617d2285343825a4

SHA1
51c0e30a411b237d69fe0d1d0b242bade406b65e

SHA256
1249a9439d2d18fe3a7b32c61dd9a3f12b242999c4e7e9f6a73a847529f314d3

SHA512
1a8e1642922b552e5cf1aa9287cc6f57d41a89eb7ef388490f133d66de0050ecf0e8f5c126d90aa34447bd4298ce795f5d7c914ff7297b81e38b50fdb77eccf8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55907.exe

Filesize
468KB

MD5
9f867b2ac86d500f7fdc2eae21da2639

SHA1
3f33e6d1b7413cba98d4b8ec6a49e5b98f9d3bad

SHA256
07f37af2e83425456be3e1acb241139b7ec76cf60e43f1ee9b587b6300c20e8f

SHA512
498dc4f5ec505dd7e7ba3facedbb49fe54e8a91b3f9425ebe37e1e26a5898409b417fd86af491016c4e293450d42cc94aaab7d6c1b322b71a6abe34c7c840f25

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62145.exe

Filesize
468KB

MD5
80cc1ecec04225c14a76444628bf8192

SHA1
76be14161a89c842604ee65856ee4b60c8e2bf1d

SHA256
a638e80b952cc1fc9bfdbf72a4d8b804ef6e1bd4047033cf56404fde18ead382

SHA512
b6284f0ba43cab5d32fb8c55f303cccae7ab4cb1bce92a434c079813d12bd25fbd42ab4a30be68375378787f2012bb4ed8aa143c1528c37878f3ca6793b7d75c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe

Filesize
468KB

MD5
eba0076ac84940f7272114b276682591

SHA1
c9d7ac67814fc28e240bce70c52beb8a390193aa

SHA256
395d084a5b5a360eb58868359edf752ab5ccf9cd4866344fef47088c5ef9bb1e

SHA512
80af7a406c189de7f947856ca3b37ebae8d7ec3301d47b388f69f607b16129a6e2c95ab8e93038e70a716ef7c1b4022bb8bf5b6377a021813c039cd5f3cb5984

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64698.exe

Filesize
468KB

MD5
b919cf33cfe6527565d3668825ac72db

SHA1
36703cc283661483266d3acead5d5d26822c61ee

SHA256
771fdc88d913543bd1bc925463b0298e7a2bdf896f836d09729a93503fb2990c

SHA512
ff6e5a044fca145736bf70cecf35b7740169836cec6954d7aa71a55eef9902db85ad4f4dfc5c74d0af2239c30116670afc9dceba65c3320150e9499b8ff682fa

Download Submit
memory/112-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/304-343-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/304-330-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/304-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/560-374-0x0000000001EE0000-0x0000000001F55000-memory.dmp

Filesize
468KB

Download
memory/560-375-0x0000000001EE0000-0x0000000001F55000-memory.dmp

Filesize
468KB

Download
memory/560-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/944-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1140-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1140-299-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1140-12-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1140-82-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1140-23-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1140-144-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1140-318-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1140-6-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1140-132-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1320-400-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/1320-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1368-239-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/1368-234-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/1368-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1796-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1828-388-0x0000000001DF0000-0x0000000001E65000-memory.dmp

Filesize
468KB

Download
memory/1828-392-0x0000000001DF0000-0x0000000001E65000-memory.dmp

Filesize
468KB

Download
memory/1828-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1844-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1876-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1992-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2016-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2036-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2036-301-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2036-125-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2036-127-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2036-320-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2144-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2164-300-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2164-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2164-322-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2168-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2200-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2200-283-0x0000000002730000-0x00000000027A5000-memory.dmp

Filesize
468KB

Download
memory/2200-284-0x0000000002730000-0x00000000027A5000-memory.dmp

Filesize
468KB

Download
memory/2288-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2296-355-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2296-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2296-359-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2316-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2320-268-0x0000000002180000-0x00000000021F5000-memory.dmp

Filesize
468KB

Download
memory/2320-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2320-267-0x0000000002180000-0x00000000021F5000-memory.dmp

Filesize
468KB

Download
memory/2352-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2412-352-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2412-192-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2412-347-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2412-193-0x00000000026D0000-0x0000000002745000-memory.dmp

Filesize
468KB

Download
memory/2444-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2444-146-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2444-271-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2444-33-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2444-69-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2444-133-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2444-269-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2460-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-401-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2688-124-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2688-230-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2688-229-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2688-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-282-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2692-165-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2692-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-281-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2860-325-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2864-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2900-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2908-246-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2908-254-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2908-48-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2944-324-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/2944-169-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/2944-175-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/2944-57-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/2944-302-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/3008-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3008-204-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3008-205-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3008-97-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3068-387-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3068-220-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3068-384-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3068-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-218-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download