fff860497b3f70a2337a90f562d888266644cfb6b5989ce7b1f9f0a7d2e2d49f

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2f935efaa31b74218e9224ab522b3110N.exe
Size

468KB
MD5

2f935efaa31b74218e9224ab522b3110
SHA1

e21cd06dc54106efedbbaada737bfeff2acce653
SHA256

fff860497b3f70a2337a90f562d888266644cfb6b5989ce7b1f9f0a7d2e2d49f
SHA512

5bdeaf671c25b445d9deb525f18a862fd1f7ad4dd5e582d034bb2e554af8e0791949e190c9122e6431dcc75b5524a8f428589ff5064213607ee61098a5b31e0a
SSDEEP

3072:hoAsogYnI05rtbY/Pz4jdf8/ECMvHhpXcmHe6Vsf+Yl1VMijkBlO:ho7om8rtsPEjdfFHmX+Y/uijk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2116	Unicorn-35158.exe
2152	Unicorn-38531.exe
2672	Unicorn-63782.exe
2532	Unicorn-38744.exe
2192	Unicorn-14986.exe
2364	Unicorn-21046.exe
2580	Unicorn-38936.exe
2072	Unicorn-38718.exe
1856	Unicorn-43548.exe
2488	Unicorn-52122.exe
2916	Unicorn-40062.exe
3008	Unicorn-33931.exe
2888	Unicorn-12028.exe
2592	Unicorn-35978.exe
1844	Unicorn-22885.exe
1532	Unicorn-38163.exe
1772	Unicorn-59138.exe
2164	Unicorn-10534.exe
1692	Unicorn-58043.exe
1652	Unicorn-65080.exe
1884	Unicorn-44468.exe
840	Unicorn-4182.exe
1308	Unicorn-57104.exe
1504	Unicorn-48174.exe
1732	Unicorn-60102.exe
1736	Unicorn-695.exe
636	Unicorn-37187.exe
2036	Unicorn-33368.exe
1620	Unicorn-45812.exe
936	Unicorn-25946.exe
1588	Unicorn-19261.exe
888	Unicorn-55817.exe
2112	Unicorn-34821.exe
3004	Unicorn-56180.exe
2096	Unicorn-41135.exe
2068	Unicorn-15552.exe
628	Unicorn-24275.exe
2736	Unicorn-52501.exe
2756	Unicorn-45795.exe
2760	Unicorn-32657.exe
2812	Unicorn-16491.exe
2696	Unicorn-21836.exe
2600	Unicorn-61053.exe
2508	Unicorn-27072.exe
2884	Unicorn-46938.exe
432	Unicorn-13311.exe
3012	Unicorn-14073.exe
2820	Unicorn-29761.exe
2848	Unicorn-62698.exe
2384	Unicorn-64928.exe
2184	Unicorn-23947.exe
1316	Unicorn-65171.exe
2956	Unicorn-30260.exe
1724	Unicorn-7781.exe
2024	Unicorn-6925.exe
1272	Unicorn-48513.exe
2076	Unicorn-46996.exe
1364	Unicorn-2841.exe
824	Unicorn-31430.exe
1796	Unicorn-57278.exe
1236	Unicorn-37412.exe
2100	Unicorn-57205.exe
556	Unicorn-7693.exe
1048	Unicorn-44450.exe

Loads dropped DLL 64 IoCs

pid	Process
2124	2f935efaa31b74218e9224ab522b3110N.exe
2124	2f935efaa31b74218e9224ab522b3110N.exe
2116	Unicorn-35158.exe
2116	Unicorn-35158.exe
2124	2f935efaa31b74218e9224ab522b3110N.exe
2124	2f935efaa31b74218e9224ab522b3110N.exe
2152	Unicorn-38531.exe
2152	Unicorn-38531.exe
2116	Unicorn-35158.exe
2116	Unicorn-35158.exe
2672	Unicorn-63782.exe
2124	2f935efaa31b74218e9224ab522b3110N.exe
2672	Unicorn-63782.exe
2124	2f935efaa31b74218e9224ab522b3110N.exe
2532	Unicorn-38744.exe
2532	Unicorn-38744.exe
2152	Unicorn-38531.exe
2152	Unicorn-38531.exe
2192	Unicorn-14986.exe
2192	Unicorn-14986.exe
2580	Unicorn-38936.exe
2116	Unicorn-35158.exe
2580	Unicorn-38936.exe
2116	Unicorn-35158.exe
2672	Unicorn-63782.exe
2672	Unicorn-63782.exe
2364	Unicorn-21046.exe
2364	Unicorn-21046.exe
2124	2f935efaa31b74218e9224ab522b3110N.exe
2124	2f935efaa31b74218e9224ab522b3110N.exe
2072	Unicorn-38718.exe
2072	Unicorn-38718.exe
2532	Unicorn-38744.exe
2532	Unicorn-38744.exe
2488	Unicorn-52122.exe
2488	Unicorn-52122.exe
2192	Unicorn-14986.exe
2192	Unicorn-14986.exe
2592	Unicorn-35978.exe
2592	Unicorn-35978.exe
1844	Unicorn-22885.exe
1844	Unicorn-22885.exe
2364	Unicorn-21046.exe
2364	Unicorn-21046.exe
1856	Unicorn-43548.exe
2124	2f935efaa31b74218e9224ab522b3110N.exe
1856	Unicorn-43548.exe
2124	2f935efaa31b74218e9224ab522b3110N.exe
2152	Unicorn-38531.exe
3008	Unicorn-33931.exe
2152	Unicorn-38531.exe
3008	Unicorn-33931.exe
2116	Unicorn-35158.exe
2116	Unicorn-35158.exe
2916	Unicorn-40062.exe
2916	Unicorn-40062.exe
2888	Unicorn-12028.exe
2580	Unicorn-38936.exe
2888	Unicorn-12028.exe
2580	Unicorn-38936.exe
2672	Unicorn-63782.exe
2672	Unicorn-63782.exe
1532	Unicorn-38163.exe
1532	Unicorn-38163.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7677.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38936.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47490.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2124	2f935efaa31b74218e9224ab522b3110N.exe
2116	Unicorn-35158.exe
2152	Unicorn-38531.exe
2672	Unicorn-63782.exe
2532	Unicorn-38744.exe
2192	Unicorn-14986.exe
2580	Unicorn-38936.exe
2364	Unicorn-21046.exe
2072	Unicorn-38718.exe
2488	Unicorn-52122.exe
2592	Unicorn-35978.exe
2916	Unicorn-40062.exe
1844	Unicorn-22885.exe
1856	Unicorn-43548.exe
2888	Unicorn-12028.exe
3008	Unicorn-33931.exe
1532	Unicorn-38163.exe
1772	Unicorn-59138.exe
2164	Unicorn-10534.exe
1692	Unicorn-58043.exe
1652	Unicorn-65080.exe
1884	Unicorn-44468.exe
840	Unicorn-4182.exe
1308	Unicorn-57104.exe
1504	Unicorn-48174.exe
1732	Unicorn-60102.exe
1736	Unicorn-695.exe
636	Unicorn-37187.exe
2036	Unicorn-33368.exe
1620	Unicorn-45812.exe
1588	Unicorn-19261.exe
936	Unicorn-25946.exe
888	Unicorn-55817.exe
2112	Unicorn-34821.exe
3004	Unicorn-56180.exe
2096	Unicorn-41135.exe
2068	Unicorn-15552.exe
628	Unicorn-24275.exe
2736	Unicorn-52501.exe
2756	Unicorn-45795.exe
2760	Unicorn-32657.exe
2812	Unicorn-16491.exe
2600	Unicorn-61053.exe
2696	Unicorn-21836.exe
2508	Unicorn-27072.exe
2884	Unicorn-46938.exe
432	Unicorn-13311.exe
3012	Unicorn-14073.exe
2820	Unicorn-29761.exe
2848	Unicorn-62698.exe
2384	Unicorn-64928.exe
2184	Unicorn-23947.exe
1316	Unicorn-65171.exe
2956	Unicorn-30260.exe
2076	Unicorn-46996.exe
2024	Unicorn-6925.exe
1724	Unicorn-7781.exe
1272	Unicorn-48513.exe
1364	Unicorn-2841.exe
824	Unicorn-31430.exe
1236	Unicorn-37412.exe
1796	Unicorn-57278.exe
2100	Unicorn-57205.exe
556	Unicorn-7693.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2116	2124	2f935efaa31b74218e9224ab522b3110N.exe	30
PID 2124 wrote to memory of 2116	2124	2f935efaa31b74218e9224ab522b3110N.exe	30
PID 2124 wrote to memory of 2116	2124	2f935efaa31b74218e9224ab522b3110N.exe	30
PID 2124 wrote to memory of 2116	2124	2f935efaa31b74218e9224ab522b3110N.exe	30
PID 2116 wrote to memory of 2152	2116	Unicorn-35158.exe	31
PID 2116 wrote to memory of 2152	2116	Unicorn-35158.exe	31
PID 2116 wrote to memory of 2152	2116	Unicorn-35158.exe	31
PID 2116 wrote to memory of 2152	2116	Unicorn-35158.exe	31
PID 2124 wrote to memory of 2672	2124	2f935efaa31b74218e9224ab522b3110N.exe	32
PID 2124 wrote to memory of 2672	2124	2f935efaa31b74218e9224ab522b3110N.exe	32
PID 2124 wrote to memory of 2672	2124	2f935efaa31b74218e9224ab522b3110N.exe	32
PID 2124 wrote to memory of 2672	2124	2f935efaa31b74218e9224ab522b3110N.exe	32
PID 2152 wrote to memory of 2532	2152	Unicorn-38531.exe	33
PID 2152 wrote to memory of 2532	2152	Unicorn-38531.exe	33
PID 2152 wrote to memory of 2532	2152	Unicorn-38531.exe	33
PID 2152 wrote to memory of 2532	2152	Unicorn-38531.exe	33
PID 2116 wrote to memory of 2192	2116	Unicorn-35158.exe	34
PID 2116 wrote to memory of 2192	2116	Unicorn-35158.exe	34
PID 2116 wrote to memory of 2192	2116	Unicorn-35158.exe	34
PID 2116 wrote to memory of 2192	2116	Unicorn-35158.exe	34
PID 2672 wrote to memory of 2580	2672	Unicorn-63782.exe	35
PID 2672 wrote to memory of 2580	2672	Unicorn-63782.exe	35
PID 2672 wrote to memory of 2580	2672	Unicorn-63782.exe	35
PID 2672 wrote to memory of 2580	2672	Unicorn-63782.exe	35
PID 2124 wrote to memory of 2364	2124	2f935efaa31b74218e9224ab522b3110N.exe	36
PID 2124 wrote to memory of 2364	2124	2f935efaa31b74218e9224ab522b3110N.exe	36
PID 2124 wrote to memory of 2364	2124	2f935efaa31b74218e9224ab522b3110N.exe	36
PID 2124 wrote to memory of 2364	2124	2f935efaa31b74218e9224ab522b3110N.exe	36
PID 2532 wrote to memory of 2072	2532	Unicorn-38744.exe	37
PID 2532 wrote to memory of 2072	2532	Unicorn-38744.exe	37
PID 2532 wrote to memory of 2072	2532	Unicorn-38744.exe	37
PID 2532 wrote to memory of 2072	2532	Unicorn-38744.exe	37
PID 2152 wrote to memory of 1856	2152	Unicorn-38531.exe	38
PID 2152 wrote to memory of 1856	2152	Unicorn-38531.exe	38
PID 2152 wrote to memory of 1856	2152	Unicorn-38531.exe	38
PID 2152 wrote to memory of 1856	2152	Unicorn-38531.exe	38
PID 2192 wrote to memory of 2488	2192	Unicorn-14986.exe	39
PID 2192 wrote to memory of 2488	2192	Unicorn-14986.exe	39
PID 2192 wrote to memory of 2488	2192	Unicorn-14986.exe	39
PID 2192 wrote to memory of 2488	2192	Unicorn-14986.exe	39
PID 2580 wrote to memory of 2916	2580	Unicorn-38936.exe	40
PID 2580 wrote to memory of 2916	2580	Unicorn-38936.exe	40
PID 2580 wrote to memory of 2916	2580	Unicorn-38936.exe	40
PID 2580 wrote to memory of 2916	2580	Unicorn-38936.exe	40
PID 2116 wrote to memory of 3008	2116	Unicorn-35158.exe	41
PID 2116 wrote to memory of 3008	2116	Unicorn-35158.exe	41
PID 2116 wrote to memory of 3008	2116	Unicorn-35158.exe	41
PID 2116 wrote to memory of 3008	2116	Unicorn-35158.exe	41
PID 2672 wrote to memory of 2888	2672	Unicorn-63782.exe	42
PID 2672 wrote to memory of 2888	2672	Unicorn-63782.exe	42
PID 2672 wrote to memory of 2888	2672	Unicorn-63782.exe	42
PID 2672 wrote to memory of 2888	2672	Unicorn-63782.exe	42
PID 2364 wrote to memory of 2592	2364	Unicorn-21046.exe	43
PID 2364 wrote to memory of 2592	2364	Unicorn-21046.exe	43
PID 2364 wrote to memory of 2592	2364	Unicorn-21046.exe	43
PID 2364 wrote to memory of 2592	2364	Unicorn-21046.exe	43
PID 2124 wrote to memory of 1844	2124	2f935efaa31b74218e9224ab522b3110N.exe	44
PID 2124 wrote to memory of 1844	2124	2f935efaa31b74218e9224ab522b3110N.exe	44
PID 2124 wrote to memory of 1844	2124	2f935efaa31b74218e9224ab522b3110N.exe	44
PID 2124 wrote to memory of 1844	2124	2f935efaa31b74218e9224ab522b3110N.exe	44
PID 2072 wrote to memory of 1532	2072	Unicorn-38718.exe	45
PID 2072 wrote to memory of 1532	2072	Unicorn-38718.exe	45
PID 2072 wrote to memory of 1532	2072	Unicorn-38718.exe	45
PID 2072 wrote to memory of 1532	2072	Unicorn-38718.exe	45

C:\Users\Admin\AppData\Local\Temp\2f935efaa31b74218e9224ab522b3110N.exe
"C:\Users\Admin\AppData\Local\Temp\2f935efaa31b74218e9224ab522b3110N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35158.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35158.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38744.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38718.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38163.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55817.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51736.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45623.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16535.exe
        8⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40813.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        8⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42861.exe
        7⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17666.exe
        7⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22401.exe
        7⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe
        7⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56180.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49852.exe
        7⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2053.exe
        8⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13236.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe
        8⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12099.exe
        7⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16535.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40813.exe
        7⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39676.exe
        6⤵
        
        PID:532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57316.exe
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15612.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21855.exe
        6⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59138.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2841.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
        7⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35094.exe
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48183.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5880.exe
        7⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        6⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52177.exe
        7⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37838.exe
        7⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61268.exe
        7⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40813.exe
        7⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        7⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47828.exe
        6⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48774.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
        6⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52213.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61617.exe
        6⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe
        6⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2373.exe
        6⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16003.exe
        6⤵
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        6⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42571.exe
        5⤵
        
        PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        5⤵
        
        PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32678.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-325.exe
        5⤵
        
        PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57104.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65171.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37901.exe
        7⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14709.exe
        7⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
        7⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39178.exe
        7⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48183.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11560.exe
        7⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34454.exe
        6⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24910.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8565.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28255.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
        5⤵
        
        PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64538.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21855.exe
        5⤵
        
        PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60102.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32007.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24803.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33383.exe
        6⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
        5⤵
        
        PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24010.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58106.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56085.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57205.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46386.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35830.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39249.exe
        5⤵
        
        PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
      4⤵
      PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54408.exe
      4⤵
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26959.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27182.exe
      4⤵
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe
      4⤵
      PID:4888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52122.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15552.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4896.exe
        7⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13609.exe
        7⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7490.exe
        7⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe
        7⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30583.exe
        7⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31761.exe
        6⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
        6⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24275.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-651.exe
        6⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        6⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48183.exe
        6⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5880.exe
        6⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3649.exe
        5⤵
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39676.exe
        5⤵
        
        PID:960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17594.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9583.exe
        5⤵
        
        PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58043.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52501.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31783.exe
        6⤵
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34150.exe
        7⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        7⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28209.exe
        7⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22544.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38893.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        6⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28227.exe
        5⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
        5⤵
        
        PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe
        5⤵
        
        PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45795.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38861.exe
        5⤵
        
        PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11175.exe
        5⤵
        
        PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe
        5⤵
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4629.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        5⤵
        
        PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24891.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe
      4⤵
      PID:264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
      4⤵
      PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32678.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-325.exe
      4⤵
      PID:4108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33931.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-695.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7693.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9119.exe
        6⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24910.exe
        5⤵
        
        PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29910.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        5⤵
        
        PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13484.exe
      4⤵
      PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        5⤵
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29991.exe
        5⤵
        
        PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
      4⤵
      PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20175.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8207.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37963.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62727.exe
        5⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28675.exe
        6⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        6⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exe
        6⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20075.exe
        5⤵
        
        PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2747.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40813.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        5⤵
        
        PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39353.exe
      4⤵
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28675.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-145.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5808.exe
        5⤵
        
        PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24741.exe
      4⤵
      PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63979.exe
      4⤵
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55052.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
      4⤵
      PID:4732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13311.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62342.exe
      4⤵
      PID:4944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22627.exe
    3⤵
    PID:1992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49304.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49304.exe
    3⤵
    PID:2408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37467.exe
    3⤵
    PID:4012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1920.exe
    3⤵
    PID:3536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64727.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63782.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63782.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40062.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33368.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe
        6⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2373.exe
        6⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22401.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
        6⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51559.exe
        5⤵
        
        PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        5⤵
        
        PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe
        5⤵
        
        PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25946.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23947.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31081.exe
        6⤵
        
        PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33271.exe
        5⤵
        
        PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47490.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe
        5⤵
        
        PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30260.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38176.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20075.exe
        5⤵
        
        PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2747.exe
        5⤵
        
        PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37552.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46271.exe
      4⤵
      PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26926.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
      4⤵
      PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32678.exe
      4⤵
      PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-325.exe
      4⤵
      PID:5008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12028.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45812.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61053.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44450.exe
        6⤵
        Executes dropped EXE
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
        6⤵
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
        6⤵
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24010.exe
        6⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58106.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56085.exe
        6⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54133.exe
        5⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44476.exe
        6⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19456.exe
        7⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1248.exe
        6⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1242.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54522.exe
        6⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14048.exe
        6⤵
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14071.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55052.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        5⤵
        
        PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27072.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19369.exe
        5⤵
        
        PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41963.exe
      4⤵
      PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57439.exe
      4⤵
      PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58468.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3552.exe
      4⤵
      PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
      4⤵
      PID:4244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19261.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14073.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34284.exe
        5⤵
        
        PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32903.exe
        5⤵
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21855.exe
        5⤵
        
        PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30754.exe
      4⤵
      PID:1284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17666.exe
      4⤵
      PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
      4⤵
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe
      4⤵
      PID:5108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
      4⤵
      PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37247.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7427.exe
      4⤵
      PID:4820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39163.exe
    3⤵
    PID:2628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32238.exe
    3⤵
    PID:2052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
    3⤵
    PID:3956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11147.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11147.exe
    3⤵
    PID:3244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60526.exe
    3⤵
    PID:4156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21046.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21046.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35978.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65080.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32657.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31430.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14279.exe
        7⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        7⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-327.exe
        7⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24910.exe
        6⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-606.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31114.exe
        6⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37412.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17673.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24910.exe
        6⤵
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28841.exe
        6⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20087.exe
        6⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
        6⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52191.exe
        5⤵
        
        PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42478.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5406.exe
        5⤵
        
        PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        5⤵
        
        PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7502.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26613.exe
        5⤵
        
        PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54922.exe
      4⤵
      PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5406.exe
      4⤵
      PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
      4⤵
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33521.exe
      4⤵
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4248.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4182.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62698.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34563.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27899.exe
        5⤵
        
        PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34231.exe
      4⤵
      PID:1192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64293.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5187.exe
      4⤵
      PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48183.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64829.exe
      4⤵
      PID:1640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22323.exe
      4⤵
      PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60008.exe
      4⤵
      PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29228.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56025.exe
      4⤵
      PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
      4⤵
      PID:4228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60080.exe
    3⤵
    PID:2840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44690.exe
    3⤵
    PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28786.exe
    3⤵
    PID:3440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-325.exe
    3⤵
    PID:5036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22885.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22885.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44468.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48513.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
      4⤵
      PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44488.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11720.exe
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21855.exe
      4⤵
      PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16491.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16491.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51736.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
      4⤵
      PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61268.exe
      4⤵
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7677.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5880.exe
      4⤵
      PID:4636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
    3⤵
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39676.exe
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17594.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17594.exe
    3⤵
    PID:3788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
    3⤵
    PID:3188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
    3⤵
    PID:4724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48174.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48174.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6925.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe
      4⤵
      PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35254.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
      4⤵
      PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22415.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24010.exe
    3⤵
    PID:3692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58106.exe
    3⤵
    PID:4696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56085.exe
    3⤵
    PID:4460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46996.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46996.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51736.exe
    3⤵
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59837.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12001.exe
      4⤵
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exe
      4⤵
      PID:4952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12099.exe
    3⤵
    PID:2620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
    3⤵
    PID:3884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48183.exe
    3⤵
    PID:3524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5880.exe
    3⤵
    PID:4768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54327.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54327.exe
  2⤵
  PID:580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
  2⤵
  PID:1952
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30980.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30980.exe
  2⤵
  PID:3828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
  2⤵
  PID:3484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36991.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36991.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12028.exe

Filesize
468KB

MD5
7d4f4ed5fdbffc2ecd685e81bad163b5

SHA1
0bc4f9f8124e5ac66170dcf94bd5b5ab3e16ac41

SHA256
5d05dcb7e5bdda22cfe188276efae6881ddf48e7f6ca33a5f14e0bfa962da3a0

SHA512
3e2cbdd0e96f79f58d853db0b867be0b4964409bffc67d08c26c073b1dc512f314bb053581e77ffc5e96c342bef22c914ae22c4f8f7246d494a76b501f3b1db6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exe

Filesize
468KB

MD5
33a5a4fb416501ff1d6ba4a79d412bce

SHA1
c67726f8b4bc5c21148d1bf1ba8e7329ddd7afd9

SHA256
1486f0e80e8b9fd7c2b61b4d36e60a0562d18da026acb9b8576b7c0cc87fa77f

SHA512
358988983bb1655c7f2a9fbe529c5c07c085215f0c342246e30ee9d1aedc8d0e13de883e1ed0afea1dfea9997dfb2b5ac8aac6d10e6820c5c1c19e57e668f67a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33931.exe

Filesize
468KB

MD5
cbb4e586c3e38faacc7ffe9c906825b5

SHA1
19cd0c57cca1bdd7a4eacaca056843802e3edb29

SHA256
de4568e085dd1a01a51fd421c35556c549d5fdd233dbbfaa0a2fc32d74ea4a4b

SHA512
d097d53e6a28d7ce963d5943aac9fa77c53d8a72cb36d56acfe6a3534d80bac134f1c9ad9d672750665445361519df97632f30b6da2de3205eb1159bb8eef0af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe

Filesize
468KB

MD5
4a011405318a0909cc2a0e9d7822d6bc

SHA1
152797a40e102c46b5d862922dd68f732d97d9cb

SHA256
538130cff1e1a25034aad25e324de9832e4eb003184722484ae916424d6c1f88

SHA512
52b0906e827130512a4db0119ffa1039eb2be22940221e13ef7dd285fcfbe3d9f78e83bfb6b3f14a6c0656f7119b302fecd8da8a5d03db12f97c418e11a78a5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40062.exe

Filesize
468KB

MD5
cb83c596800102b5545a355f12dea939

SHA1
de61961cf1959060faa8864ced78bc9f28394f3a

SHA256
6852db23f1517717d1d49163a3f38086dd474e2373ee1c852f1d684991759706

SHA512
1b12391dade3ec3bd19e75d2c4ca438db4d80b7a61e386e34e177dd75406a773aaefc8fb3b142f5adae76b76dc447415b57d2ea6f5bdb9a18bb659371a09fa16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52122.exe

Filesize
468KB

MD5
e8694f4fce019a928caf6933cd18c780

SHA1
305af8609adde2d771e460634d99e4bd4de89e9f

SHA256
51a990d1758af0faf6d084024c1d80a38cbda8b18c862b6f7b279b69be545fdf

SHA512
3ec63b57a9d8d0d3c5bcbe9a265825e1bcbfef6f739e2247b8b6288d31083d92a45dffdddd75ae9c0a0a7ed134e0fdda792071aa91a1b7bebfeba4eaa9c6a156

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe

Filesize
468KB

MD5
3ccd715ef1f871643335e17cb04e0010

SHA1
6143280f6bbd9bbf6ab3c92f45de4901ed7761e1

SHA256
17b71122751e2df07845b0d523ac056ebdc712e591999e9842013ed1c785783c

SHA512
aef449e616fe4bccfe695d8115ef512c4c4dee5eb8cc38aee0543505510ececdf32c5ca468647a116a8ff8462f16dfa744d9c69a3e1824cf651087f26218486e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21046.exe

Filesize
468KB

MD5
724b36fda2f0314b94c8f6a1bca583fb

SHA1
c66cfc1a0374e88214ceadbc25361aef91c17351

SHA256
34fdd9de69bc65f7a74e17718b6d6ddc3956fcc000252cf34104fa35b0380a9f

SHA512
e59b91b8330cbca48e0293599f209f4ba83f7980b9651bb4c72c8c5ebe35d251a78dc4a9ad2f151247af209f2560977440aaa4e3da67289b0f3286634432af2f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22885.exe

Filesize
468KB

MD5
259040011e4046345e81eee1e8a08d78

SHA1
d36d6d019069ac04e55cbba126ab4ae8649b230a

SHA256
c5e034a58106a37701f68900430086a40453c86413768b03ca15e907c437e694

SHA512
61d10350b4fa9976fa50a8d859bf74c70900a2eed4285230800c64557e476f179552d1c9bd04703b4187e1e0318930b739ee865664f496cec04ea50980725081

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35158.exe

Filesize
468KB

MD5
4ca5906532c12d3a754d58fdc9451294

SHA1
19a8d56f0e01834c10bca5aa3d04308517fc020a

SHA256
00c160e977339366ac063f714fc7738f248cd37362035d0ea9bccd35583f5fe6

SHA512
b013625856af591b05d7d479d2bcef75d262308c990802f695718c7b2668b6981365fd71fb6cf66995866ceead3bf066307231f4ca1fcdd969ef51f5bc8efb66

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35978.exe

Filesize
468KB

MD5
ef83860ebbd574a2e272827d2c01b43f

SHA1
6c1dad70b2fbdaeafc897eb3531841f641b34702

SHA256
06be79c582ac051b94eb66cf182d5b9f9b854d390d22472961833c4b92f6b1bb

SHA512
726083ea6861946a59d75bae2f876267520e8d66df483d8900834855595d0c0106a33de4edc20662eced8c6b0a34bc90dbf52f5292f1a3a9cfdd18bb564aaf13

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38163.exe

Filesize
468KB

MD5
796aac03f3ff2e93fbb7a4c496ec9e9c

SHA1
4c6f42acb4b68ca441aa3bfc7224a9deece04056

SHA256
d53b5037b382de47426bb84a8f995a82da92646bde4552144e453b2b40585d29

SHA512
ed99083f41b52b3db4285643e2c248bd80374fbf10d7f20aee2eecc6a77ea4df6746731647ea9d81674f8f94099ee148b035a38ec003352fabf344b4d144dd44

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38718.exe

Filesize
468KB

MD5
d7dc723f73c505218de9df9a2b6b21e4

SHA1
791f6db934301306425fdf108cf6dd49b952c809

SHA256
4ea57cda9bc8844c3fc4adaee5e6a4060080b9592df8120c0ff4b48937e71ac5

SHA512
031182b165bdbd4eecd1110f274df3cc5acdcb7e40fa5d5e912a88dfdf6baf6969735632646efc2b14bbecc142f588707073d1c158661d5bcec27755700e10c5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38744.exe

Filesize
468KB

MD5
997105cf3ab896b6226f7d295528fef6

SHA1
fc9b5e150fe953511ee4e58e770fb8a9f1842233

SHA256
34288acd4d2efa2bf360c617829e860ceb0fcaddce4ab9df14eeb0cb7716d742

SHA512
fd0c360bed23273363f184808ccd67a9c0c3f46963efd1a3ae05f0222b9356a1993cde482d053912d9dd62ab85db755d956fa74dda8c076619f472165675d8ce

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38936.exe

Filesize
468KB

MD5
dea9900ef0d6b40c7d0f2b1f2f5116c2

SHA1
b5574d53b6d2e2555dac6520d93c14e380e141a5

SHA256
78bef66a479c04a72c9fc470878019548c41eb864961cfda575eaafe7a868e0b

SHA512
acfe7d6ad4014a2188d62a999515b0de9e335f26aa3929fbf0ed04b8f2e3810f11441075cbe55c7af197f34d2fb2447f3a73e56e5173b43a30f231feb81d9a14

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe

Filesize
468KB

MD5
04f598ec37b57d77f3a8181230adad33

SHA1
f190f8e1e30683b16a8eb2b1493a3889fb6a74b2

SHA256
104599198a3e4d1f67d70db4edb13da14d6d38af7f71185af1ad74cd42143c4c

SHA512
d77e9275176d516bc1e59e8bd5807e0618bf6c7a2cd7a913261e78dc1ad357883a4c238294af473e161352668185b4713b2d76458c7bb7a694cba85d473ae404

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58043.exe

Filesize
468KB

MD5
1111df64d0966e98d590376b4cefe904

SHA1
d76a20feb92ee7cef4a9ab3dd9e49d62f69b0d2a

SHA256
aeb42e7c69960b3662c7fccf7542f15ddc05f43353bfa202154d98c87a267c33

SHA512
7d151a1354e331232462717d9ee8bbaebbcea54cf3a2f06c842b8a3465d9f8244f0a9d2081dc9787344b2bf2107c33098cb7d32958110ba5b85f386a0505e2e6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59138.exe

Filesize
468KB

MD5
f32cc4bcb9ae064427cad8e8830b4285

SHA1
8b8ef1f44d913a48d6eb6f324cc4aa8c69e27efb

SHA256
106432283241b2bcbd512fe2f4c2ff94633d781f32d96c1a40846989ef03d331

SHA512
c3facabb949f9936c201b2c9e684ae43d5166f85c464863a5d173ddb998f647313a83f55fc3704005662cbed5d6d9e187cdf4836f6555b1331eb66a6e6fd5c00

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63782.exe

Filesize
468KB

MD5
0731c5d0c0e70374b068949dcd9b1107

SHA1
2c7aefbdde7bc0b221551b17c9820e6507903e2a

SHA256
56fc2dd9891f442c36e96c67dfcc545456c3f9a048975e4f1e172055e75577cb

SHA512
19f16ffb1cf017d87654fac7ad5cbf243bdbc9eb5e0480ef262d08c47fc11f6eabafa7fc940c57934c359b6dd46b8f5ed0813064d375bd3a6d538241f39c0fea

Download Submit