11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe
Size

468KB
MD5

131b61a9ee3520e4231c19fcb821d378
SHA1

8bbc2348a8774e29b18ec24353032c0debad29f0
SHA256

11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79
SHA512

f6f39a57705fcc6a50a50cf69f5420ba4e7f0f4d2e6778a612131650a0562fa87179fb5f99fd027b89d6d58e1ca7becf9ae8295419179a7a89001b0fb934b260
SSDEEP

3072:LbtjogIdI05UtbYVPzsjlf8/ECrCZIpVnmH9xVhhpadLj/5RmHlw:LbRow8UtKPojlfT087paZb5Rm

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
320	Unicorn-45187.exe
2940	Unicorn-53993.exe
2912	Unicorn-26796.exe
2808	Unicorn-40776.exe
2932	Unicorn-30561.exe
2880	Unicorn-5965.exe
1220	Unicorn-59805.exe
1392	Unicorn-18841.exe
2452	Unicorn-18841.exe
2200	Unicorn-39161.exe
2268	Unicorn-45291.exe
2884	Unicorn-45026.exe
1968	Unicorn-56152.exe
828	Unicorn-13256.exe
2628	Unicorn-57526.exe
1228	Unicorn-31560.exe
2396	Unicorn-26713.exe
2092	Unicorn-4917.exe
2116	Unicorn-49577.exe
1048	Unicorn-49842.exe
1016	Unicorn-42228.exe
1260	Unicorn-39536.exe
1812	Unicorn-36006.exe
480	Unicorn-51788.exe
1916	Unicorn-3355.exe
1564	Unicorn-62762.exe
2224	Unicorn-65363.exe
1988	Unicorn-62862.exe
2508	Unicorn-6462.exe
2528	Unicorn-37865.exe
2532	Unicorn-6681.exe
884	Unicorn-47787.exe
1928	Unicorn-31451.exe
1668	Unicorn-22321.exe
2188	Unicorn-12976.exe
2352	Unicorn-15691.exe
2324	Unicorn-61362.exe
2892	Unicorn-39433.exe
2172	Unicorn-18191.exe
2772	Unicorn-13360.exe
2652	Unicorn-49494.exe
2748	Unicorn-3822.exe
2736	Unicorn-1684.exe
2712	Unicorn-61091.exe
1096	Unicorn-9852.exe
1712	Unicorn-65083.exe
2440	Unicorn-58953.exe
2616	Unicorn-45794.exe
2312	Unicorn-23235.exe
1200	Unicorn-19151.exe
2972	Unicorn-32795.exe
1216	Unicorn-18139.exe
1264	Unicorn-12182.exe
2160	Unicorn-4325.exe
632	Unicorn-50262.exe
2100	Unicorn-41347.exe
1448	Unicorn-50070.exe
744	Unicorn-46308.exe
2132	Unicorn-29156.exe
1472	Unicorn-50968.exe
1948	Unicorn-28410.exe
2244	Unicorn-41216.exe
1492	Unicorn-13919.exe
1356	Unicorn-47979.exe

Loads dropped DLL 64 IoCs

pid	Process
584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe
584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe
584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe
320	Unicorn-45187.exe
584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe
320	Unicorn-45187.exe
2912	Unicorn-26796.exe
584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe
2940	Unicorn-53993.exe
320	Unicorn-45187.exe
2940	Unicorn-53993.exe
2912	Unicorn-26796.exe
320	Unicorn-45187.exe
584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe
2932	Unicorn-30561.exe
1220	Unicorn-59805.exe
2932	Unicorn-30561.exe
1220	Unicorn-59805.exe
584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe
320	Unicorn-45187.exe
2808	Unicorn-40776.exe
320	Unicorn-45187.exe
584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe
2808	Unicorn-40776.exe
2912	Unicorn-26796.exe
2912	Unicorn-26796.exe
2880	Unicorn-5965.exe
2880	Unicorn-5965.exe
2940	Unicorn-53993.exe
2940	Unicorn-53993.exe
2884	Unicorn-45026.exe
2884	Unicorn-45026.exe
584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe
584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe
2200	Unicorn-39161.exe
2200	Unicorn-39161.exe
320	Unicorn-45187.exe
2268	Unicorn-45291.exe
320	Unicorn-45187.exe
2268	Unicorn-45291.exe
2808	Unicorn-40776.exe
2808	Unicorn-40776.exe
1392	Unicorn-18841.exe
1392	Unicorn-18841.exe
2932	Unicorn-30561.exe
2932	Unicorn-30561.exe
1968	Unicorn-56152.exe
1968	Unicorn-56152.exe
2452	Unicorn-18841.exe
2912	Unicorn-26796.exe
2452	Unicorn-18841.exe
2912	Unicorn-26796.exe
1220	Unicorn-59805.exe
1220	Unicorn-59805.exe
828	Unicorn-13256.exe
828	Unicorn-13256.exe
2880	Unicorn-5965.exe
2880	Unicorn-5965.exe
2628	Unicorn-57526.exe
2628	Unicorn-57526.exe
2940	Unicorn-53993.exe
2940	Unicorn-53993.exe
2396	Unicorn-26713.exe
1228	Unicorn-31560.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41373.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe
320	Unicorn-45187.exe
2940	Unicorn-53993.exe
2912	Unicorn-26796.exe
2808	Unicorn-40776.exe
2932	Unicorn-30561.exe
1220	Unicorn-59805.exe
2880	Unicorn-5965.exe
1392	Unicorn-18841.exe
2452	Unicorn-18841.exe
2884	Unicorn-45026.exe
2268	Unicorn-45291.exe
2200	Unicorn-39161.exe
1968	Unicorn-56152.exe
828	Unicorn-13256.exe
2628	Unicorn-57526.exe
2396	Unicorn-26713.exe
1228	Unicorn-31560.exe
2092	Unicorn-4917.exe
1048	Unicorn-49842.exe
2116	Unicorn-49577.exe
1016	Unicorn-42228.exe
1260	Unicorn-39536.exe
1812	Unicorn-36006.exe
480	Unicorn-51788.exe
1916	Unicorn-3355.exe
1564	Unicorn-62762.exe
2224	Unicorn-65363.exe
1988	Unicorn-62862.exe
2508	Unicorn-6462.exe
2528	Unicorn-37865.exe
2532	Unicorn-6681.exe
1668	Unicorn-22321.exe
1928	Unicorn-31451.exe
884	Unicorn-47787.exe
2188	Unicorn-12976.exe
2352	Unicorn-15691.exe
2324	Unicorn-61362.exe
2892	Unicorn-39433.exe
2172	Unicorn-18191.exe
2772	Unicorn-13360.exe
2652	Unicorn-49494.exe
2748	Unicorn-3822.exe
1712	Unicorn-65083.exe
1096	Unicorn-9852.exe
2736	Unicorn-1684.exe
2712	Unicorn-61091.exe
2440	Unicorn-58953.exe
2616	Unicorn-45794.exe
1200	Unicorn-19151.exe
2312	Unicorn-23235.exe
2972	Unicorn-32795.exe
1216	Unicorn-18139.exe
1264	Unicorn-12182.exe
632	Unicorn-50262.exe
2100	Unicorn-41347.exe
2160	Unicorn-4325.exe
1448	Unicorn-50070.exe
744	Unicorn-46308.exe
1472	Unicorn-50968.exe
2132	Unicorn-29156.exe
1948	Unicorn-28410.exe
2244	Unicorn-41216.exe
1492	Unicorn-13919.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 584 wrote to memory of 320	584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe	30
PID 584 wrote to memory of 320	584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe	30
PID 584 wrote to memory of 320	584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe	30
PID 584 wrote to memory of 320	584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe	30
PID 584 wrote to memory of 2940	584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe	32
PID 584 wrote to memory of 2940	584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe	32
PID 584 wrote to memory of 2940	584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe	32
PID 584 wrote to memory of 2940	584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe	32
PID 320 wrote to memory of 2912	320	Unicorn-45187.exe	31
PID 320 wrote to memory of 2912	320	Unicorn-45187.exe	31
PID 320 wrote to memory of 2912	320	Unicorn-45187.exe	31
PID 320 wrote to memory of 2912	320	Unicorn-45187.exe	31
PID 2940 wrote to memory of 2808	2940	Unicorn-53993.exe	35
PID 2912 wrote to memory of 2880	2912	Unicorn-26796.exe	33
PID 2940 wrote to memory of 2808	2940	Unicorn-53993.exe	35
PID 2940 wrote to memory of 2808	2940	Unicorn-53993.exe	35
PID 2912 wrote to memory of 2880	2912	Unicorn-26796.exe	33
PID 2912 wrote to memory of 2880	2912	Unicorn-26796.exe	33
PID 2940 wrote to memory of 2808	2940	Unicorn-53993.exe	35
PID 2912 wrote to memory of 2880	2912	Unicorn-26796.exe	33
PID 320 wrote to memory of 1220	320	Unicorn-45187.exe	36
PID 320 wrote to memory of 1220	320	Unicorn-45187.exe	36
PID 320 wrote to memory of 1220	320	Unicorn-45187.exe	36
PID 320 wrote to memory of 1220	320	Unicorn-45187.exe	36
PID 584 wrote to memory of 2932	584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe	34
PID 584 wrote to memory of 2932	584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe	34
PID 584 wrote to memory of 2932	584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe	34
PID 584 wrote to memory of 2932	584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe	34
PID 2932 wrote to memory of 1392	2932	Unicorn-30561.exe	37
PID 2932 wrote to memory of 1392	2932	Unicorn-30561.exe	37
PID 2932 wrote to memory of 1392	2932	Unicorn-30561.exe	37
PID 2932 wrote to memory of 1392	2932	Unicorn-30561.exe	37
PID 1220 wrote to memory of 2452	1220	Unicorn-59805.exe	38
PID 1220 wrote to memory of 2452	1220	Unicorn-59805.exe	38
PID 1220 wrote to memory of 2452	1220	Unicorn-59805.exe	38
PID 1220 wrote to memory of 2452	1220	Unicorn-59805.exe	38
PID 320 wrote to memory of 2200	320	Unicorn-45187.exe	40
PID 320 wrote to memory of 2200	320	Unicorn-45187.exe	40
PID 320 wrote to memory of 2200	320	Unicorn-45187.exe	40
PID 320 wrote to memory of 2200	320	Unicorn-45187.exe	40
PID 584 wrote to memory of 2884	584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe	39
PID 584 wrote to memory of 2884	584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe	39
PID 584 wrote to memory of 2884	584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe	39
PID 584 wrote to memory of 2884	584	11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe	39
PID 2808 wrote to memory of 2268	2808	Unicorn-40776.exe	41
PID 2808 wrote to memory of 2268	2808	Unicorn-40776.exe	41
PID 2808 wrote to memory of 2268	2808	Unicorn-40776.exe	41
PID 2808 wrote to memory of 2268	2808	Unicorn-40776.exe	41
PID 2912 wrote to memory of 1968	2912	Unicorn-26796.exe	42
PID 2912 wrote to memory of 1968	2912	Unicorn-26796.exe	42
PID 2912 wrote to memory of 1968	2912	Unicorn-26796.exe	42
PID 2912 wrote to memory of 1968	2912	Unicorn-26796.exe	42
PID 2880 wrote to memory of 828	2880	Unicorn-5965.exe	43
PID 2880 wrote to memory of 828	2880	Unicorn-5965.exe	43
PID 2880 wrote to memory of 828	2880	Unicorn-5965.exe	43
PID 2880 wrote to memory of 828	2880	Unicorn-5965.exe	43
PID 2940 wrote to memory of 2628	2940	Unicorn-53993.exe	44
PID 2940 wrote to memory of 2628	2940	Unicorn-53993.exe	44
PID 2940 wrote to memory of 2628	2940	Unicorn-53993.exe	44
PID 2940 wrote to memory of 2628	2940	Unicorn-53993.exe	44
PID 2884 wrote to memory of 1228	2884	Unicorn-45026.exe	45
PID 2884 wrote to memory of 1228	2884	Unicorn-45026.exe	45
PID 2884 wrote to memory of 1228	2884	Unicorn-45026.exe	45
PID 2884 wrote to memory of 1228	2884	Unicorn-45026.exe	45

C:\Users\Admin\AppData\Local\Temp\11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe
"C:\Users\Admin\AppData\Local\Temp\11c992e24d1aa05520ebb534ce948f0165c861796bff327f831571750cd60f79.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5965.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41347.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        8⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8835.exe
        8⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6111.exe
        8⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
        8⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        8⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45021.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
        7⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        7⤵
        
        PID:788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17866.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        7⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50070.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
        7⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39580.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        7⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-593.exe
        6⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29168.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65010.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5049.exe
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe
        6⤵
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6462.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12182.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        7⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe
        8⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17625.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54713.exe
        8⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32010.exe
        8⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5955.exe
        7⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe
        7⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10703.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27992.exe
        7⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8026.exe
        7⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18996.exe
        7⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65275.exe
        6⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50496.exe
        7⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21087.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
        7⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56679.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31695.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11010.exe
        7⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16353.exe
        6⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3739.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54616.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57335.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe
        6⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4325.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26387.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49887.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34810.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63330.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41671.exe
        5⤵
        
        PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27400.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53925.exe
        5⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45349.exe
        5⤵
        
        PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56152.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41216.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50178.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9982.exe
        6⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38215.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-927.exe
        6⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        6⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35477.exe
        6⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49553.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60239.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58756.exe
        5⤵
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
        5⤵
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23889.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15254.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        5⤵
        
        PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62762.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32795.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        6⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38540.exe
        7⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41258.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
        7⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
        7⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
        7⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38632.exe
        6⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60859.exe
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38567.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53521.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61352.exe
        6⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11010.exe
        6⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52451.exe
        5⤵
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25831.exe
        5⤵
        
        PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52194.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27769.exe
        5⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6461.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19712.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9875.exe
        5⤵
        
        PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        5⤵
        
        PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7553.exe
        5⤵
        
        PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38567.exe
        5⤵
        
        PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59260.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41149.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10097.exe
      4⤵
      PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe
        5⤵
        
        PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28595.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
      4⤵
      PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2818.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
      4⤵
      PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17306.exe
      4⤵
      PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47676.exe
      4⤵
      PID:5572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59805.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18841.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3355.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54341.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18507.exe
        7⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62983.exe
        7⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
        7⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38414.exe
        6⤵
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
        6⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20765.exe
        6⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43864.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11010.exe
        6⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        6⤵
        
        PID:1136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7553.exe
        6⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57861.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38215.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
        6⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23011.exe
        5⤵
        
        PID:920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27154.exe
        5⤵
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7283.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39437.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe
        5⤵
        
        PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65363.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50968.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56353.exe
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27411.exe
        6⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe
        5⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
        6⤵
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26618.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44286.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        6⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        5⤵
        
        PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45972.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        6⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34810.exe
        6⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22031.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22755.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39821.exe
        5⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe
        5⤵
        
        PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13919.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44668.exe
      4⤵
      PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51971.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7283.exe
      4⤵
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe
      4⤵
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe
      4⤵
      PID:5564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39161.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4917.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15691.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28410.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe
        6⤵
        
        PID:612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18507.exe
        6⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30766.exe
        6⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10164.exe
        6⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47979.exe
        5⤵
        Executes dropped EXE
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6142.exe
        6⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30205.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20666.exe
        6⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23390.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40843.exe
        6⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
        5⤵
        
        PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24373.exe
        5⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
        5⤵
        
        PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18441.exe
        5⤵
        
        PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39256.exe
        5⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe
        5⤵
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50687.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43902.exe
        5⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41294.exe
      4⤵
      PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10625.exe
      4⤵
      PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
      4⤵
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7283.exe
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18441.exe
      4⤵
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32317.exe
      4⤵
      PID:5808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49577.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
        6⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41965.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
        7⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26618.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe
        7⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43334.exe
        7⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15475.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14315.exe
        6⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe
        6⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38567.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27652.exe
        6⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1191.exe
        5⤵
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10152.exe
        5⤵
        
        PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56552.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53630.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        5⤵
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29156.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-693.exe
        5⤵
        
        PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22753.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34978.exe
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46158.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42117.exe
        5⤵
        
        PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22959.exe
      4⤵
      PID:568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18359.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59230.exe
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40676.exe
        5⤵
        
        PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63267.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
      4⤵
      PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
      4⤵
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
      4⤵
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe
      4⤵
      PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54362.exe
      4⤵
      PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2634.exe
      4⤵
      PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3789.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43643.exe
        5⤵
        
        PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48025.exe
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
      4⤵
      PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54484.exe
      4⤵
      PID:5824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39420.exe
    3⤵
    PID:1800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16216.exe
    3⤵
    PID:2184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20140.exe
    3⤵
    PID:3472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
    3⤵
    PID:3900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58126.exe
    3⤵
    PID:4180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exe
    3⤵
    PID:6068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53993.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53993.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40776.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45291.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9852.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44762.exe
        7⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59266.exe
        7⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35904.exe
        7⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44286.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        7⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27506.exe
        6⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57594.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5614.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
        6⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23235.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41965.exe
        6⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36978.exe
        7⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23853.exe
        7⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35904.exe
        7⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14629.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59183.exe
        7⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19141.exe
        6⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14724.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exe
        6⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-593.exe
        5⤵
        
        PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9982.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
        5⤵
        
        PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16681.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44056.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11010.exe
        5⤵
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42228.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3822.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62769.exe
        6⤵
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40735.exe
        6⤵
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61801.exe
        6⤵
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38798.exe
        5⤵
        
        PID:832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42991.exe
        5⤵
        
        PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        5⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5614.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
        5⤵
        
        PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37932.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40676.exe
        5⤵
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22218.exe
      4⤵
      PID:1904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5380.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24605.exe
      4⤵
      PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18396.exe
      4⤵
      PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59260.exe
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14507.exe
      4⤵
      PID:5948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57526.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37865.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42062.exe
        5⤵
        
        PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
        5⤵
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39097.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49055.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61129.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36517.exe
        5⤵
        
        PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6765.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59121.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32511.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40676.exe
        5⤵
        
        PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-593.exe
      4⤵
      PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24373.exe
      4⤵
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
      4⤵
      PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8705.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
      4⤵
      PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37652.exe
      4⤵
      PID:5836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6681.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe
      4⤵
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        5⤵
        
        PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4751.exe
        5⤵
        
        PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45006.exe
        5⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
        5⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59183.exe
        5⤵
        
        PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe
      4⤵
      PID:752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42991.exe
      4⤵
      PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20765.exe
      4⤵
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe
      4⤵
      PID:4712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56667.exe
    3⤵
    PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62269.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8715.exe
    3⤵
    PID:1504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
    3⤵
    PID:3540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2818.exe
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56201.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8781.exe
    3⤵
    PID:5756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18841.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39536.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13360.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32842.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        7⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33573.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17524.exe
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10613.exe
        7⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33811.exe
        6⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61486.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        6⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21149.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31695.exe
        6⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37652.exe
        6⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        5⤵
        
        PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14682.exe
        5⤵
        
        PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45972.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22031.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33630.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22317.exe
        5⤵
        
        PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49494.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        5⤵
        
        PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        5⤵
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58756.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9961.exe
      4⤵
      PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
      4⤵
      PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19805.exe
      4⤵
      PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18441.exe
      4⤵
      PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32317.exe
      4⤵
      PID:5812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36006.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1684.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31782.exe
        5⤵
        
        PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18507.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59183.exe
        5⤵
        
        PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38414.exe
      4⤵
      PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
      4⤵
      PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
      4⤵
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5614.exe
      4⤵
      PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11010.exe
      4⤵
      PID:5408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58953.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60901.exe
      4⤵
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12883.exe
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17188.exe
      4⤵
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32010.exe
      4⤵
      PID:5360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15707.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24605.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36871.exe
    3⤵
    PID:4244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59260.exe
    3⤵
    PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14507.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14507.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5940
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45026.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45026.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31560.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31560.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47787.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60008.exe
        5⤵
        
        PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51373.exe
        5⤵
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41367.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13184.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60822.exe
        5⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15475.exe
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38414.exe
      4⤵
      PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
      4⤵
      PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65422.exe
      4⤵
      PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
      4⤵
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41373.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61362.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57102.exe
      4⤵
      PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61409.exe
      4⤵
      PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
      4⤵
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43523.exe
      4⤵
      PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61801.exe
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
      4⤵
      PID:5340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52150.exe
    3⤵
    PID:2320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38742.exe
    3⤵
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
    3⤵
    PID:2360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33126.exe
    3⤵
    PID:3964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18441.exe
    3⤵
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe
    3⤵
    PID:5652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26713.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26713.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
      4⤵
      PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19141.exe
      4⤵
      PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26532.exe
      4⤵
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59183.exe
      4⤵
      PID:5712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38414.exe
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
    3⤵
    PID:2208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
    3⤵
    PID:464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54815.exe
    3⤵
    PID:4112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
    3⤵
    PID:4456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
    3⤵
    PID:6060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22321.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22321.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
    3⤵
    PID:2372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8835.exe
    3⤵
    PID:2344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
    3⤵
    PID:3380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63480.exe
    3⤵
    PID:4104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
    3⤵
    PID:4152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59183.exe
    3⤵
    PID:5528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49880.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49880.exe
  2⤵
  PID:2316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9076.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9076.exe
  2⤵
  PID:2724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14805.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14805.exe
  2⤵
  PID:3476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14205.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14205.exe
  2⤵
  PID:4220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30390.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30390.exe
  2⤵
  PID:5068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64950.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64950.exe
  2⤵
  PID:6000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-26713.exe

Filesize
468KB

MD5
45af16aa9a1e5988160ea2b1f1ff4109

SHA1
fd7437583797880e9bbd9cbdd41f840991ff7f69

SHA256
47f2e9d730e235ac827090140203e3aa52f75b90b9c1c3501661e2000bf72c2f

SHA512
7d16b28460458208410e48bc003ec85a3e28830bb4dd66ec9b8a0c19857353896879013436715d920495210d4d3dd06a8dba3238f7077d6282609ce82349c4ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe

Filesize
468KB

MD5
08a1b75b99b907b101d9ec86b80c2234

SHA1
14daba9141ac79d2ff3b6e967c36d1e35d0bdadf

SHA256
a3a89d51ceb808bd55be17e7d5f9b95cbfe2790f9d92d1611a187ffba0793a89

SHA512
c2f857fa662473eba976a32a32d05973a5b15e403ad3586d207e2d0b23b7b0890e5a674310ef9b65c67fefa624a2f2b4dc6b60ad7338ce1a1b79207814bee817

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44762.exe

Filesize
468KB

MD5
3293221eb821928bbeeabb190ba6045f

SHA1
2c3487625f39c3962a7ae7d54bb6b47defc4c9e1

SHA256
be449a813dee56afeb14d303ef187acf0300546f025e24646a95ea56496c64bf

SHA512
d557957e13d55433c6e5bbbd0e1d305d34264b4f462b4fe7dfd0679bb42da1afbb5e6da78b541d6590d2e8f9dedcd4a740a91cacc92b2e05872b7325cc018f9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45291.exe

Filesize
468KB

MD5
d307f1e849aa0d1d157e54bf1fa3792f

SHA1
76098dd2fbb39a53afd1c4dd21ffca684a388444

SHA256
a90da8a5350c1431c02b850cb241582b24c88d0923fdbb98df42d007b2e6bd50

SHA512
671042226990ee96cf114b512dcb3b4e57120d1716245a8f96dcd0fa5fe45e68dd18e92d4ec50d8159a66e2461b3a7cef6cbf9fd292baddf002d2ca50244c743

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56152.exe

Filesize
468KB

MD5
f8da034ea704744047c905a8c06c20cc

SHA1
14333ff69ace5fbced3e9e1b40d7d0e562b3e90c

SHA256
254306343aaa5ed185321bd18af03e8d12ae80711aa908f18c6d25d55b538dbe

SHA512
6e67751cd2126607d737fa70498fc1e3395d8aafa00b9c5b85bc57d5300ebe898bb57c6a71feaffde2667e6ae5a52ae00c82a45b4330c233e86238ffaa8bf36d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe

Filesize
468KB

MD5
85f68e4f6068f9b64785f4520d028fa7

SHA1
040f0685cac50adbbd3683c02682b56484ba4f73

SHA256
fc247c9c46864f0a321fc7e64dffe2f8c06c1250c61fda48f4c9f58948967675

SHA512
07ddf0638c16228cf355a72f42cc27c981a2b35caab0f8a1f2bcd29f5443a338e1c4fb1e6b0da99b500aec23387187d2c52cd63c97473e92e45471c50fcddc55

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18841.exe

Filesize
468KB

MD5
13e57d4488e958fddfd843d82395af63

SHA1
574cafe709d34face70a692be2dfc08a9bca2f0f

SHA256
1b949326fd6b581ad1ca514b551189445d44582620c7afba940a11bb12f0c5fa

SHA512
877ee6441d47a7f361ee7aaea8421f40b02545d4457396b0b13f3b198f2f1faf40e62d646f0cd496d83ebe7ab2c5918d029d69b2f1810fab0ba4119495cae6aa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe

Filesize
468KB

MD5
1df58b96193c3a973dc7f6607648228d

SHA1
168bf87b1b18f494c8492bd572fbcc23862e61a9

SHA256
c15d5845312a02285a9e32c10919ce705da99a9f4e511222949be3e22a2d61ab

SHA512
0e6e00eda666654a801ba5f6f6e87663b03e8951a39ea5d6b58bfe2aa51d2b121254778a5448314810cddd7da58dc07242aa355e28ebc25f5ca69fa1e2f639e4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31560.exe

Filesize
468KB

MD5
6d40d601ef4fed5f7322e3f671e45944

SHA1
b407627a53bdf1020f19dc49c88662d6f3829a89

SHA256
a2287b786eedcc1488eb6ccd75e83be14031d0d84649ecbec65516ac503eb192

SHA512
435cea673c45d9aa1c8f8edd7f0c6f91a6998d87fc8e167f4f03d05cef8a8c95c29e7f889869318b4dc9660384b6a72d82de21528966219fda28256f33119b30

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39161.exe

Filesize
468KB

MD5
1c436201058c334214ea604f8795e4cc

SHA1
afbbde3b0dd355274812bcf019d818532e020beb

SHA256
1ca550ab92f948feddfafedcc51d6d03f38237da48ac65998b9d0ce39ab940c5

SHA512
145c0548c8dedb9b286baeaf3317a38103487f89f353e475986301f0d1aace8f5dd5fbcb47c9c76ad756ae4696e26bf81b420b1e3fd9078b2965ae715882be4d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40776.exe

Filesize
468KB

MD5
d8be0bc1436eef5401d3c5fd311ff6b2

SHA1
fe39f21c11605abec2b4ed1eadcd7f9455d0e6f9

SHA256
59522c7ac27c929e00e7d5f95fdafbc04e830620299185c50ce3e71feebf2af9

SHA512
c44bea09d008fdc19b383112c5a562bce8ec1bce0b4e8cff7c8bc7b7eae0bcdd8468bfebdf568496e3db27c402a8b3c20cbd1391cea926be27d177beae6360bb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45026.exe

Filesize
468KB

MD5
c33a61c4208e633fe2dab8086a38db87

SHA1
685c594ff0e9888b355aab0ac53d61b1c9b53741

SHA256
d8d89faa11dd40e7706dc997be445a6cd58462c19044e860d3a1ec5b165e5b51

SHA512
8e22fd40cd722d98e816f460507b7e8cca08bb285df73fc55ef2f0019d784511b77d8e5fbe849db7120004021130fd8712433ca9b5d8f6b88c03f4979d7a31be

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe

Filesize
468KB

MD5
82676dc25cdc13e3c7c57bf7094d6496

SHA1
4778d792061b9540d2b217073e6ee816f86c6844

SHA256
cccc8b9fd662cc0fc895219e7844db3386f4eef85f9c3bfccf0db4d64bc2bdb0

SHA512
ce5c795b7f454c2bd3e97303247a37665ea7974478e7c6d2c4173a891200946e2fc1180f2c036bb389d6df959c6b7d1aeecaa4b60ca22b1932d37907e44ec55c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53993.exe

Filesize
468KB

MD5
a4e84877afc1ad62ccd93d58727b20df

SHA1
2c47cb075c9920d25ffe86426095891231f72aec

SHA256
f9739c1e3cb582878aeddad4db575ad1d310cc38371beff04b98e52cf127eebd

SHA512
1d134fc9d590a42fa373e9bea59e11f67b68b901c84029d640d008b7450358562fd0372c8158319f81db2f0e334e6eaeaae5023951b10981ff7b288a50bb7973

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57526.exe

Filesize
468KB

MD5
875eea81c8f2ec65796b74ac94942180

SHA1
0652d10b87f913d435a2e1d1605c531602b07c59

SHA256
6dceb2f81e0dad2593d70e098557478234bafe13235fd70836015d6c0fee4553

SHA512
5b2b03f5e175adb3923556cc1ceae9239bfe3a4e9749e40f2ec0a144166221010008f727fcefa0f697162d2e068ed2c41ecb2399bb95c42aba2983bc10d8fe38

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5965.exe

Filesize
468KB

MD5
cd7fcb3ef155c3dd8d13ea4c8c24e309

SHA1
699354cbf4116d489ef5ff156b3c846d313f7d32

SHA256
32660e91feafdbbc76fb608a1a4b370077a847f785ecd45f72db0d8773bcd3b9

SHA512
7b429f028c6a6d77216e0113aff72154c52d5d4a27d4645bdb7c9ed803e9ecf9142650773876fb64827f177dbcb3b59ab05844488575a002db212e91fbae5abc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59805.exe

Filesize
468KB

MD5
43cecbee15fce9e47afb2ab8e4e1ebd1

SHA1
24543f2ac71a5d54d00c78a7d552583122e8a38a

SHA256
b9e947c718b4f8c319cb9a49f028ad3f7eda3a0b627a96b53b550aee3aaa6229

SHA512
e4b757f72c5b6f5aa0f387a1a95f68fa1e9128c8a59935ac412d6ee18d40f386724ed0c81fcc8f4fb2d9035f0c1b8c52cbcf7a1dc82de80fb9c86d9194bef35f

Download Submit