9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe
Size

468KB
MD5

397c3e89ee1bddcfa9e3140289a4e165
SHA1

6986f6864cbd8608e8d877a186c141b2d34cda6f
SHA256

9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d
SHA512

92814c272e126b435fb2242b9c3b13d69df9b891a69dbc8049aa6256a557adbbd8673c4753699f25de153a728afbc6f2960a549b4a064c81d0215d11736c6ba4
SSDEEP

3072:ToA1ogYnI05ptbYFkPz4jef8/ECxvPgpXcmHe6AKc85XsiAiuYQlJ:ToCom8ptZPEjefWcmD85cniuY

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2740	Unicorn-22228.exe
2972	Unicorn-10935.exe
2516	Unicorn-64775.exe
2564	Unicorn-44359.exe
2680	Unicorn-6934.exe
2568	Unicorn-60795.exe
2404	Unicorn-26539.exe
1544	Unicorn-38128.exe
2836	Unicorn-48169.exe
596	Unicorn-64770.exe
1644	Unicorn-34620.exe
2152	Unicorn-34711.exe
2396	Unicorn-20976.exe
1296	Unicorn-16892.exe
1780	Unicorn-40842.exe
2980	Unicorn-37298.exe
1228	Unicorn-33768.exe
2820	Unicorn-58294.exe
1796	Unicorn-23598.exe
1384	Unicorn-37189.exe
940	Unicorn-29383.exe
888	Unicorn-57417.exe
1244	Unicorn-37089.exe
2832	Unicorn-20661.exe
1864	Unicorn-20661.exe
2260	Unicorn-61593.exe
768	Unicorn-6581.exe
2408	Unicorn-6846.exe
2452	Unicorn-46296.exe
1276	Unicorn-624.exe
1936	Unicorn-17707.exe
2164	Unicorn-5092.exe
876	Unicorn-21328.exe
2888	Unicorn-58185.exe
1584	Unicorn-63016.exe
2964	Unicorn-48071.exe
2716	Unicorn-44563.exe
2708	Unicorn-4707.exe
2348	Unicorn-22559.exe
2508	Unicorn-27843.exe
1712	Unicorn-55232.exe
912	Unicorn-50977.exe
1128	Unicorn-60577.exe
2604	Unicorn-4791.exe
936	Unicorn-10913.exe
2996	Unicorn-29872.exe
1272	Unicorn-48246.exe
808	Unicorn-32010.exe
1484	Unicorn-2772.exe
1160	Unicorn-3037.exe
1656	Unicorn-41116.exe
1512	Unicorn-26172.exe
776	Unicorn-54760.exe
2300	Unicorn-11873.exe
2216	Unicorn-31439.exe
2192	Unicorn-21896.exe
2952	Unicorn-21896.exe
972	Unicorn-19326.exe
2868	Unicorn-19326.exe
1620	Unicorn-33061.exe
1756	Unicorn-39192.exe
3020	Unicorn-57666.exe
2284	Unicorn-105.exe
1288	Unicorn-47260.exe

Loads dropped DLL 64 IoCs

pid	Process
3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe
3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe
3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe
2740	Unicorn-22228.exe
3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe
2740	Unicorn-22228.exe
2516	Unicorn-64775.exe
3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe
2516	Unicorn-64775.exe
3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe
2972	Unicorn-10935.exe
2972	Unicorn-10935.exe
2740	Unicorn-22228.exe
2740	Unicorn-22228.exe
2564	Unicorn-44359.exe
2564	Unicorn-44359.exe
3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe
3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe
2680	Unicorn-6934.exe
2680	Unicorn-6934.exe
2404	Unicorn-26539.exe
2404	Unicorn-26539.exe
2740	Unicorn-22228.exe
2740	Unicorn-22228.exe
2516	Unicorn-64775.exe
2972	Unicorn-10935.exe
2972	Unicorn-10935.exe
2516	Unicorn-64775.exe
2568	Unicorn-60795.exe
2568	Unicorn-60795.exe
1544	Unicorn-38128.exe
1544	Unicorn-38128.exe
2564	Unicorn-44359.exe
2564	Unicorn-44359.exe
2836	Unicorn-48169.exe
2836	Unicorn-48169.exe
3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe
3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe
1644	Unicorn-34620.exe
1644	Unicorn-34620.exe
2404	Unicorn-26539.exe
2404	Unicorn-26539.exe
1296	Unicorn-16892.exe
1296	Unicorn-16892.exe
2972	Unicorn-10935.exe
2972	Unicorn-10935.exe
2396	Unicorn-20976.exe
2152	Unicorn-34711.exe
2396	Unicorn-20976.exe
2152	Unicorn-34711.exe
2516	Unicorn-64775.exe
2516	Unicorn-64775.exe
2740	Unicorn-22228.exe
2740	Unicorn-22228.exe
596	Unicorn-64770.exe
596	Unicorn-64770.exe
2680	Unicorn-6934.exe
1780	Unicorn-40842.exe
2680	Unicorn-6934.exe
1780	Unicorn-40842.exe
2568	Unicorn-60795.exe
2568	Unicorn-60795.exe
1228	Unicorn-33768.exe
1228	Unicorn-33768.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5216.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe
2740	Unicorn-22228.exe
2516	Unicorn-64775.exe
2972	Unicorn-10935.exe
2680	Unicorn-6934.exe
2564	Unicorn-44359.exe
2568	Unicorn-60795.exe
2404	Unicorn-26539.exe
1544	Unicorn-38128.exe
2836	Unicorn-48169.exe
596	Unicorn-64770.exe
2396	Unicorn-20976.exe
1296	Unicorn-16892.exe
1780	Unicorn-40842.exe
2152	Unicorn-34711.exe
1644	Unicorn-34620.exe
2980	Unicorn-37298.exe
1228	Unicorn-33768.exe
2820	Unicorn-58294.exe
1796	Unicorn-23598.exe
1384	Unicorn-37189.exe
888	Unicorn-57417.exe
1244	Unicorn-37089.exe
940	Unicorn-29383.exe
1864	Unicorn-20661.exe
2832	Unicorn-20661.exe
768	Unicorn-6581.exe
2260	Unicorn-61593.exe
1936	Unicorn-17707.exe
2408	Unicorn-6846.exe
1276	Unicorn-624.exe
2452	Unicorn-46296.exe
2164	Unicorn-5092.exe
876	Unicorn-21328.exe
2888	Unicorn-58185.exe
1584	Unicorn-63016.exe
2964	Unicorn-48071.exe
2348	Unicorn-22559.exe
2716	Unicorn-44563.exe
2708	Unicorn-4707.exe
2508	Unicorn-27843.exe
1712	Unicorn-55232.exe
912	Unicorn-50977.exe
1128	Unicorn-60577.exe
2604	Unicorn-4791.exe
936	Unicorn-10913.exe
2996	Unicorn-29872.exe
1272	Unicorn-48246.exe
808	Unicorn-32010.exe
1484	Unicorn-2772.exe
1160	Unicorn-3037.exe
1656	Unicorn-41116.exe
1512	Unicorn-26172.exe
2216	Unicorn-31439.exe
776	Unicorn-54760.exe
2192	Unicorn-21896.exe
2300	Unicorn-11873.exe
2952	Unicorn-21896.exe
972	Unicorn-19326.exe
1756	Unicorn-39192.exe
2868	Unicorn-19326.exe
1620	Unicorn-33061.exe
3020	Unicorn-57666.exe
2284	Unicorn-105.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2740	3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe	30
PID 3028 wrote to memory of 2740	3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe	30
PID 3028 wrote to memory of 2740	3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe	30
PID 3028 wrote to memory of 2740	3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe	30
PID 3028 wrote to memory of 2516	3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe	31
PID 3028 wrote to memory of 2516	3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe	31
PID 3028 wrote to memory of 2516	3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe	31
PID 3028 wrote to memory of 2516	3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe	31
PID 2740 wrote to memory of 2972	2740	Unicorn-22228.exe	32
PID 2740 wrote to memory of 2972	2740	Unicorn-22228.exe	32
PID 2740 wrote to memory of 2972	2740	Unicorn-22228.exe	32
PID 2740 wrote to memory of 2972	2740	Unicorn-22228.exe	32
PID 3028 wrote to memory of 2564	3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe	34
PID 3028 wrote to memory of 2564	3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe	34
PID 3028 wrote to memory of 2564	3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe	34
PID 3028 wrote to memory of 2564	3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe	34
PID 2516 wrote to memory of 2680	2516	Unicorn-64775.exe	33
PID 2516 wrote to memory of 2680	2516	Unicorn-64775.exe	33
PID 2516 wrote to memory of 2680	2516	Unicorn-64775.exe	33
PID 2516 wrote to memory of 2680	2516	Unicorn-64775.exe	33
PID 2972 wrote to memory of 2568	2972	Unicorn-10935.exe	35
PID 2972 wrote to memory of 2568	2972	Unicorn-10935.exe	35
PID 2972 wrote to memory of 2568	2972	Unicorn-10935.exe	35
PID 2972 wrote to memory of 2568	2972	Unicorn-10935.exe	35
PID 2740 wrote to memory of 2404	2740	Unicorn-22228.exe	36
PID 2740 wrote to memory of 2404	2740	Unicorn-22228.exe	36
PID 2740 wrote to memory of 2404	2740	Unicorn-22228.exe	36
PID 2740 wrote to memory of 2404	2740	Unicorn-22228.exe	36
PID 2564 wrote to memory of 1544	2564	Unicorn-44359.exe	37
PID 2564 wrote to memory of 1544	2564	Unicorn-44359.exe	37
PID 2564 wrote to memory of 1544	2564	Unicorn-44359.exe	37
PID 2564 wrote to memory of 1544	2564	Unicorn-44359.exe	37
PID 3028 wrote to memory of 2836	3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe	38
PID 3028 wrote to memory of 2836	3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe	38
PID 3028 wrote to memory of 2836	3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe	38
PID 3028 wrote to memory of 2836	3028	9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe	38
PID 2680 wrote to memory of 596	2680	Unicorn-6934.exe	39
PID 2680 wrote to memory of 596	2680	Unicorn-6934.exe	39
PID 2680 wrote to memory of 596	2680	Unicorn-6934.exe	39
PID 2680 wrote to memory of 596	2680	Unicorn-6934.exe	39
PID 2404 wrote to memory of 1644	2404	Unicorn-26539.exe	40
PID 2404 wrote to memory of 1644	2404	Unicorn-26539.exe	40
PID 2404 wrote to memory of 1644	2404	Unicorn-26539.exe	40
PID 2404 wrote to memory of 1644	2404	Unicorn-26539.exe	40
PID 2740 wrote to memory of 2152	2740	Unicorn-22228.exe	41
PID 2740 wrote to memory of 2152	2740	Unicorn-22228.exe	41
PID 2740 wrote to memory of 2152	2740	Unicorn-22228.exe	41
PID 2740 wrote to memory of 2152	2740	Unicorn-22228.exe	41
PID 2972 wrote to memory of 1296	2972	Unicorn-10935.exe	43
PID 2972 wrote to memory of 1296	2972	Unicorn-10935.exe	43
PID 2972 wrote to memory of 1296	2972	Unicorn-10935.exe	43
PID 2972 wrote to memory of 1296	2972	Unicorn-10935.exe	43
PID 2516 wrote to memory of 2396	2516	Unicorn-64775.exe	42
PID 2516 wrote to memory of 2396	2516	Unicorn-64775.exe	42
PID 2516 wrote to memory of 2396	2516	Unicorn-64775.exe	42
PID 2516 wrote to memory of 2396	2516	Unicorn-64775.exe	42
PID 2568 wrote to memory of 1780	2568	Unicorn-60795.exe	44
PID 2568 wrote to memory of 1780	2568	Unicorn-60795.exe	44
PID 2568 wrote to memory of 1780	2568	Unicorn-60795.exe	44
PID 2568 wrote to memory of 1780	2568	Unicorn-60795.exe	44
PID 1544 wrote to memory of 2980	1544	Unicorn-38128.exe	45
PID 1544 wrote to memory of 2980	1544	Unicorn-38128.exe	45
PID 1544 wrote to memory of 2980	1544	Unicorn-38128.exe	45
PID 1544 wrote to memory of 2980	1544	Unicorn-38128.exe	45

C:\Users\Admin\AppData\Local\Temp\9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe
"C:\Users\Admin\AppData\Local\Temp\9cea262490163497b27fd36e24b696672babdf6e81c4679db4a494495f4d7d0d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22228.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22228.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10935.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40842.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-105.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52467.exe
        8⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
        8⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2336.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3580.exe
        8⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7645.exe
        7⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        7⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        7⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64938.exe
        7⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        7⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8527.exe
        6⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe
        6⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19914.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54254.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63380.exe
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4791.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4848.exe
        7⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
        7⤵
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        7⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29058.exe
        7⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25212.exe
        7⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
        6⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43218.exe
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        7⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61508.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6392.exe
        7⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        6⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21228.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61203.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14874.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10913.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53390.exe
        6⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        7⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49908.exe
        7⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
        7⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20698.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        7⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        7⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55794.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10907.exe
        6⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44848.exe
        5⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10754.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23750.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe
        6⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25148.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59313.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16226.exe
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61104.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe
        5⤵
        
        PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16892.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3037.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55845.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46712.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2336.exe
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42475.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46950.exe
        6⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        6⤵
        
        PID:1084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
        6⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60022.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41116.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56618.exe
        6⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
        6⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18137.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61508.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2308.exe
        6⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56710.exe
        5⤵
        
        PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe
        5⤵
        
        PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51134.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17144.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61203.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8652.exe
        5⤵
        
        PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37089.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32010.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11922.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54823.exe
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6423.exe
        6⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        5⤵
        
        PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45824.exe
        5⤵
        
        PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2772.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31621.exe
        5⤵
        
        PID:932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        5⤵
        
        PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57885.exe
      4⤵
      PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60862.exe
      4⤵
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20076.exe
      4⤵
      PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
      4⤵
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56875.exe
      4⤵
      PID:5804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26539.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34620.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37189.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27843.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38267.exe
        7⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62840.exe
        8⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
        8⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61308.exe
        8⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        8⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22037.exe
        8⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59210.exe
        8⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48350.exe
        7⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe
        7⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        7⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
        7⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
        7⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55211.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36622.exe
        6⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17859.exe
        6⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
        6⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11114.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44072.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        6⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55232.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39192.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58974.exe
        7⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23498.exe
        7⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25332.exe
        7⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31095.exe
        7⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33218.exe
        6⤵
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        6⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe
        6⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32783.exe
        5⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58506.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13802.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43160.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
        5⤵
        
        PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29383.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54760.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
        6⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        6⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        6⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62160.exe
        6⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        5⤵
        
        PID:1120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
        5⤵
        
        PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe
        5⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33229.exe
        5⤵
        
        PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11873.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43360.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26237.exe
        5⤵
        
        PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
      4⤵
      PID:1348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
      4⤵
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
      4⤵
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16905.exe
      4⤵
      PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62129.exe
      4⤵
      PID:5272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50977.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62373.exe
        6⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
        7⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe
        7⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        7⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28067.exe
        7⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43117.exe
        7⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
        6⤵
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53992.exe
        6⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23156.exe
        5⤵
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
        5⤵
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26058.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57448.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        5⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        5⤵
        
        PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60577.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57666.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56624.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe
        6⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11729.exe
        5⤵
        
        PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25404.exe
        5⤵
        
        PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47260.exe
      4⤵
      Executes dropped EXE
      PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11393.exe
      4⤵
      PID:424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
      4⤵
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe
      4⤵
      PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55867.exe
      4⤵
      PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2546.exe
      4⤵
      PID:5644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6581.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26172.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36570.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29610.exe
        5⤵
        
        PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49856.exe
      4⤵
      PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
      4⤵
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
      4⤵
      PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
      4⤵
      PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
      4⤵
      PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13048.exe
      4⤵
      PID:5556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31439.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2176.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24702.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3580.exe
      4⤵
      PID:5176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22273.exe
    3⤵
    PID:2052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19417.exe
    3⤵
    PID:3984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55576.exe
    3⤵
    PID:4124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8646.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8646.exe
    3⤵
    PID:3904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38593.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38593.exe
    3⤵
    PID:5252
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64775.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64775.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6934.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21896.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1039.exe
        6⤵
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        6⤵
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        6⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35518.exe
        6⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23075.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39018.exe
        6⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28479.exe
        5⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
        5⤵
        
        PID:672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40418.exe
        5⤵
        
        PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37757.exe
        5⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44072.exe
        5⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58428.exe
        5⤵
        
        PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29872.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43406.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31621.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe
        7⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        7⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29442.exe
        7⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        7⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        7⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
        6⤵
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        6⤵
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        6⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3745.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65487.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24049.exe
        6⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40452.exe
        5⤵
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3845.exe
        6⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
        5⤵
        
        PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28580.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
        5⤵
        
        PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5904.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48246.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45689.exe
        5⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4527.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2830.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2336.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42475.exe
        6⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
        5⤵
        
        PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
        5⤵
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61532.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        5⤵
        
        PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4391.exe
      4⤵
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
        5⤵
        
        PID:368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18491.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5216.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8201.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33809.exe
        5⤵
        
        PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
      4⤵
      PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46061.exe
      4⤵
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18389.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60911.exe
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58872.exe
      4⤵
      PID:2232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20976.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21896.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1802.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        6⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30781.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2308.exe
        6⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11755.exe
        5⤵
        
        PID:472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        5⤵
        
        PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1698.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-66.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-66.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
        5⤵
        
        PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17916.exe
        5⤵
        
        PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20275.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        5⤵
        
        PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61508.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6392.exe
        5⤵
        
        PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
      4⤵
      PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe
      4⤵
      PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27767.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38737.exe
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
      4⤵
      PID:5196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61593.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61593.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23131.exe
      4⤵
      PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
      4⤵
      PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26525.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
      4⤵
      PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22414.exe
      4⤵
      PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50100.exe
      4⤵
      PID:5440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55730.exe
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
    3⤵
    PID:2200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44307.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40948.exe
    3⤵
    PID:2424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58145.exe
    3⤵
    PID:4488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe
    3⤵
    PID:4556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34317.exe
    3⤵
    PID:5748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44359.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44359.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38128.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58185.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        6⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56085.exe
        6⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48537.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
        6⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28584.exe
        5⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11403.exe
        6⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20780.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28597.exe
        6⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
        5⤵
        
        PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5799.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39947.exe
        5⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
        5⤵
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63016.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3058.exe
        5⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe
        6⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47916.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18135.exe
        6⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63643.exe
        5⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        5⤵
        
        PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2082.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61519.exe
        5⤵
        
        PID:920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39451.exe
        5⤵
        
        PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56243.exe
      4⤵
      PID:316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe
      4⤵
      PID:868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19990.exe
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16905.exe
      4⤵
      PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11810.exe
      4⤵
      PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45600.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34911.exe
        5⤵
        
        PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49380.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46278.exe
        5⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32653.exe
        5⤵
        
        PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3504.exe
      4⤵
      PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5528.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
      4⤵
      PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44972.exe
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe
      4⤵
      PID:5232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21328.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe
      4⤵
      PID:592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26276.exe
        5⤵
        
        PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
        5⤵
        
        PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5885.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        5⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61508.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49222.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54760.exe
        5⤵
        
        PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe
      4⤵
      PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
      4⤵
      PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24081.exe
      4⤵
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41825.exe
      4⤵
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11906.exe
      4⤵
      PID:5996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42757.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42757.exe
    3⤵
    PID:3040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11393.exe
    3⤵
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16905.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
    3⤵
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58044.exe
    3⤵
    PID:5408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48071.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30168.exe
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42258.exe
        5⤵
        
        PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19899.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4415.exe
        5⤵
        
        PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63167.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44729.exe
      4⤵
      PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
      4⤵
      PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37757.exe
      4⤵
      PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35712.exe
      4⤵
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23618.exe
      4⤵
      PID:6120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22559.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26831.exe
      4⤵
      PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
      4⤵
      PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
      4⤵
      PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31158.exe
      4⤵
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
      4⤵
      PID:5344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64255.exe
    3⤵
    PID:2804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42487.exe
    3⤵
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30116.exe
    3⤵
    PID:3600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58693.exe
    3⤵
    PID:4024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16905.exe
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16195.exe
    3⤵
    PID:4764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58044.exe
    3⤵
    PID:5396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23598.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23598.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44563.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44563.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61641.exe
      4⤵
      PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
      4⤵
      PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
      4⤵
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe
      4⤵
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4163.exe
      4⤵
      PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
      4⤵
      PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10095.exe
      4⤵
      PID:5484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38267.exe
    3⤵
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe
    3⤵
    PID:2664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17392.exe
    3⤵
    PID:3224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
    3⤵
    PID:4204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64560.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64560.exe
    3⤵
    PID:4720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63380.exe
    3⤵
    PID:5360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4707.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4707.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35383.exe
    3⤵
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59794.exe
      4⤵
      PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4636.exe
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18843.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
    3⤵
    PID:1352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32916.exe
    3⤵
    PID:3612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
    3⤵
    PID:4348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
    3⤵
    PID:2160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe
    3⤵
    PID:5864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29121.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29121.exe
  2⤵
  PID:2496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
  2⤵
  PID:1520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36261.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36261.exe
  2⤵
  PID:3728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61261.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61261.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32041.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32041.exe
  2⤵
  PID:4132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61002.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61002.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62435.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62435.exe
  2⤵
  PID:5432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1039.exe

Filesize
468KB

MD5
ea6dc61a933b417b14897e89797b8736

SHA1
f569353b4f8d7268e4420937b163c207877d678d

SHA256
9fbcee6871538fd6ca5dbe6ad0eec2f118599907a46e670c97ac998c0b06b8b0

SHA512
c5b074aab06d7cfa385b9725a6d60d6d87b0779aca066f6a35af5656f33d63ae0ffdd5f674e4e36d2f0ca7a58f1363306d22e7b4dc4a58b237a10f53aec5b9a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10935.exe

Filesize
468KB

MD5
5f85d4e053c209b2623703a0ec11fadd

SHA1
3a781fe7b61b670a6baa6926cf123778aa7be8ec

SHA256
c192b7182ddfe2e8a53ac2eb51a553c834b86d9704b52b20057b4b7f0b3eeaa3

SHA512
f4419facfa2f5446f01abc1935969c060c20785872bd0dc603590a6d50b8819babc014f51399f00c9d155922c1d553701547af42eb1360edbbaadeef71d257f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16892.exe

Filesize
468KB

MD5
731899778a93eab003caaf49f4b2851a

SHA1
6489623fba9066bc47dc4a41ba0e7524e1ceefb8

SHA256
df4369335f5420ba510cb725393f2e102b703e81d82f3392e9ced85696c72f8a

SHA512
4d4c45a3f9367cce15fd982cbe83822d2dce587f2a2214aa23878c7e9bb14444f3db189a9c8a0d2fc859616414f5b2b206534b7b43f246c44e8acfb402a6b27a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44307.exe

Filesize
468KB

MD5
8ed807a6b82158f8bcf8531881f50a50

SHA1
8e3bb92088ac502f66689a6a8ed41232d1c528a8

SHA256
257027fab1e379dd485eee3425d27c8dd33bfbb2a8a531b3d714812c0e6f7f41

SHA512
028ef2913e8066d8dec7df382c7273441eaf5d79a3a75830b1c33270c4350b510505aa4e9998764f3677f55d9df4c3c133fad1477c311c34fb4d8c4ae135f411

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46278.exe

Filesize
468KB

MD5
526bdf690611c8a00557649dcd20042a

SHA1
5c884900b77364460e66f8bf0abeb38a88d2841e

SHA256
aa531e9f3f363e4b33efdc48a1b10385394141f856727dd15c673909c4c54e17

SHA512
ad6981376ec977d188efd670dc14236ce1c65dcfbea74dcee4a98f761b19903cbea020a760a794a05cc11c9e793b3213cdf43bb3726fa0fb0dfe92efb31108e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe

Filesize
468KB

MD5
7e403d3cac06e5f86efc3489a82aad50

SHA1
b158f4243ac0c8d66230c9dae8ead551b8c3c3c0

SHA256
abf5995bd20a0cdcfcc69f871e94b2fd6c60afcb4e07e70d688c34e76c39c4b0

SHA512
3bfeec5d125ca62e982aff5214857ad2975c7c728475fb71806fbaa32282af8a6f7b317212fd105750bcd13f51febd0f83f6e6f2f92f08a4d2e78da691a26154

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20976.exe

Filesize
468KB

MD5
86adeb9edce09c97ec4c964d6007778c

SHA1
c07b3b7ffa8ba8a65293ae878c306342ece1e338

SHA256
4ca4fa2aad125f184d25afa09b71f8cf264ab608f63ae921c07680946ee2eb19

SHA512
fc5a94cbc02798e2057569048f83f2c5211450d511a457b03aa4248df2a2bea209230a48eafe3133bd3d8d74c5333bb6b914db55b6a49aa7eb192491c3266577

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22228.exe

Filesize
468KB

MD5
998d4fcbf8ca07e3d1bb46a7a3a2be22

SHA1
f715f06fd2ef10d437575d1189a1e381acd213bd

SHA256
2dbcb62c3507c65086a3fd177a6ddf4ceef025bc4106350c671ca5199b8d13f2

SHA512
e425fa6ffe1d077275ea04c1723a7d644827b09d770d7946ec273c6527b568200c68cb253e20164537c75da2584d244fc04ce4324c12b77f4a8614a72953aa5c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23598.exe

Filesize
468KB

MD5
5e9fce60ade3562487acdfda707134dd

SHA1
8ece820c23eadc0b6582ad419e15688c32ba3c1b

SHA256
03deae6b0a5c4e029e3cea8ab9bef408eb979fa13dd942a3cd91151ceca1309c

SHA512
7eb4a51157c5d7b6e7e9bd9f2ae65d9a7d29e80d9507f7b8dff9c4272f4dc55a0d4a4a1cd1b7def24721328e61d5955a34744d6698baf740cd5b743155dbddd2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26539.exe

Filesize
468KB

MD5
44948e4a6839e079547e74cd1076e434

SHA1
b402139d2fdcab8f5ada41822ef110d930abb75b

SHA256
b5a28aca247c8209aff508aa992988f8031232cd29523d7c382b6b4a26c5111e

SHA512
b35fe8cf832760fa9a1d20552cefb0a5d6dd50adcb4b29b24f1cc0c5fad7fff56bacfcd29819734494839768c8e386d5d81505e76af527e66503d1a315bd17b1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe

Filesize
468KB

MD5
05d7f3c541fee4811c772d6c150dbef3

SHA1
05b522a92701d7bdc120c39ae138b87b56e99c51

SHA256
c2d1416ba19e9ac2d068c31e2630fcd3e1356c15cbcfb2cc74c1e9e2c1677aa2

SHA512
58dcc72663a74c4ee14e4d34bab7676f4464f2cb140df1406591522f18ef7be5d1e7370d92ca49c32e69e3ef9a0a9c1d8903ee8a250cba4f659f6325187c6fe1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34620.exe

Filesize
468KB

MD5
4d191032edaca86b88decd3fc744ac4e

SHA1
83da9bdf9cf01357a549fe17fa589e3a55684496

SHA256
8eaed3fc50252169d872b13fa32c375ebbba70b98a16f48cf74c20333deed64f

SHA512
9051ea327f2f8abae63109911d98709dce2cfdf6eb934aa5e458cbca621cdec6e88bd3d06e6b3d80724460ba94d50d5df2bebe7c8ad51a17de145687780a7909

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe

Filesize
468KB

MD5
3840da8543eae9d5d842646ac72ca93f

SHA1
d3d4ca367ca67b952213f03942f59e8a3a007d4d

SHA256
446169fea28b945686a20015e0efe7a4d4dfd49a504bf4030d9d744b2701c61f

SHA512
eb789e58f9a3f1c208b94e25e53533c39f90f462c94cbbdc38fef0f8589842324e3028ebf31d98ea32f597f20d98672a40cb2b299880dcb034fbc574812eedbd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe

Filesize
468KB

MD5
8074c2f435500e9d5c5955dcf1b11824

SHA1
0a3d7a9b498bac3de81341549a05fc8dbc165e40

SHA256
ee5699491cddd23ff5d98ef7e7768e2300a13a7898df3b8d915ab692a018c2b2

SHA512
381be8aa301c1e18dddc2c793f4a4f58418a3fa02f4047893a0226efe25bb5e78f9e2a87000ef813e2989f71f4044d814b25462d73089dd7e425c62fcfa6cc55

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38128.exe

Filesize
468KB

MD5
21ad4384dfab4e02ea586ff4e9cecddf

SHA1
ac094c589dbbff97f2b54257734301a5fd63559a

SHA256
d2c460d8f82f28aa8a39541eecced06b14269296b94b94fed077bbcc81ccf39b

SHA512
8af2a87b608a6cdb92e2a6a35a5708c85939f89b45dd6e14b44cfc88ebb6852a29c362d0d6a11a878efc4aff1b17bf84d7f8ed454d846c59eb0d7661efed6cd0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40842.exe

Filesize
468KB

MD5
c6d007d16605331833729bfeb2c8a3dc

SHA1
9b63f2b6289789cb192310d7352e76e1e006d750

SHA256
360968aa51787c10f8cc28d4b74e474b38f7712cc917966660f755ccc9c2050c

SHA512
cc7c8ed3b2e1ec87050dc94da5e79dcf65fccdf6f910cfa649bda4fd4219ff7e8d19a09db5862098af5fd24ef5d207e5504d093dc9baaaa85a7b4a8f4c0e4f64

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44359.exe

Filesize
468KB

MD5
89c4ab23fc2722c0eacfa4a8b7dd37d7

SHA1
af6086569496422d3e263809a6c86f9421eb5dd9

SHA256
47b3f30cf52f54f4f9d19736f5bd5a32d7e650957bf889848ecbb696a970d3ef

SHA512
9d2c71b2d29ee866c5737c26dede9e08fccc10f26020b5713260f3fd34726c414aa863cd646977bd60d4da6fde03620786ad51bd64b6ea7d3c3013598a4a550d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe

Filesize
468KB

MD5
abd3cf512defee1a3e6c63a0987a6708

SHA1
b1d914a0cd41501175a8de2644a53868df1f28b9

SHA256
76fae4be21a6df13ebf4411c06f285822efc3959af7a96fbfc0e115fbf880b9f

SHA512
84f3c321ec8b7fb131f330fd2c9ba8ed1d4862812fd8d63c12186e0c8782e98104284050be3b50809b5badf19fb76b8dcb62ba17ceed3d4667888a1095a14c5a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60795.exe

Filesize
468KB

MD5
4033348f6c4432c973c81b2b4cac736c

SHA1
d088228d8857b46d526f0adab017584f392ddba9

SHA256
a3359304ed0f79929115a3c5ce4249ef65e493c8777aab119578f28ec3764c5c

SHA512
3e5b1c4edea0e1162ffe040dbdfbfe6306561bbbf75fad3cc81da52eaf556bd0fa2753405464e9d59205625632a83a0a36d706a610d2a2c6eced473afa2b12ca

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe

Filesize
468KB

MD5
cff44a678dc6a61d3f741947733019da

SHA1
df19cf2e94a8a40499ba6d56f1d99b91531c1fa2

SHA256
e7e584413a43c330749b0fc06093a226db12a095d53eacba39a4e506224ccf16

SHA512
a3b7beb0ea0e04e1b3e1799aa5f63b1b555860c78f07e240df028eb7795b073ec72e9af46d9509695d263f3574dc23823bd983d5d026e99bfc5a148bab5242aa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64775.exe

Filesize
468KB

MD5
9d838f9899ab12a41830609aa3fdbde7

SHA1
9d77949e61e1f346494a0684e6d6353a4951a75d

SHA256
c43d80bc1337acb928c440e043cad5c32c2df4bafe3caf933dc141966d3201ac

SHA512
5f9e95bec8ada63f45dba4e43c1db2d281054773e18530133148e494e8590313afcf25dae63dcbd032600b094dddca6b58937150886dc865f5ab6d73a76a4739

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6934.exe

Filesize
468KB

MD5
8ad8230c40a8a759f38440ec0492108c

SHA1
1fc33aaf5ea6d5d16492cf7db6626e9c8ca8a452

SHA256
3154a9263bda97ed22fa2499f2bd894b7280ed0fa9c54b261ceb379a9a12312f

SHA512
4a085b5b992d3f244686e86e3663ee19dacce4fa43601a8832eafd896929fc85cad74a35949ce3cb52696536e0545177e65bacc9112d67ced27cef09a7f8bafe

Download Submit