4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82a

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe
Size

468KB
MD5

2f33f629323faa1d4fbe7e7586e71d20
SHA1

40ce4cf1fb6c0760e67d57ba50806539c902c73c
SHA256

4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82a
SHA512

346ada2eefecb77c9464a4bdbe191cb74c530b9ab59aae018e303464c51abbe888f045fd85c8e075f21a7b93e0a2eb3de196a16d0d24e16deb953b2fdc2cce54
SSDEEP

3072:dbXIog5ZP88U2aYVPzivff8/MC7AZ4pxhdHeZVXD7SXNPuJTvWxF:dbYoiRU2dPevffFE0X7S9GJTv

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2288	Unicorn-49307.exe
2792	Unicorn-38079.exe
2864	Unicorn-8936.exe
2132	Unicorn-20167.exe
2956	Unicorn-13844.exe
2776	Unicorn-19975.exe
2324	Unicorn-16253.exe
2376	Unicorn-38501.exe
1580	Unicorn-57084.exe
2880	Unicorn-43820.exe
2172	Unicorn-10217.exe
1052	Unicorn-16348.exe
2916	Unicorn-30581.exe
2216	Unicorn-23695.exe
2444	Unicorn-48880.exe
2404	Unicorn-62346.exe
2076	Unicorn-2969.exe
748	Unicorn-41226.exe
2328	Unicorn-53544.exe
2544	Unicorn-25357.exe
1036	Unicorn-24131.exe
2036	Unicorn-63348.exe
1712	Unicorn-23585.exe
2088	Unicorn-53323.exe
1184	Unicorn-29716.exe
472	Unicorn-29716.exe
2072	Unicorn-36750.exe
2608	Unicorn-36247.exe
2332	Unicorn-18715.exe
2768	Unicorn-40414.exe
2960	Unicorn-6983.exe
2976	Unicorn-26081.exe
1648	Unicorn-33153.exe
2712	Unicorn-37451.exe
3004	Unicorn-35235.exe
2380	Unicorn-33663.exe
2564	Unicorn-19365.exe
3028	Unicorn-2910.exe
3056	Unicorn-28373.exe
2912	Unicorn-53839.exe
2224	Unicorn-30435.exe
820	Unicorn-39366.exe
1176	Unicorn-7871.exe
1780	Unicorn-29657.exe
2148	Unicorn-29657.exe
1148	Unicorn-45946.exe
1920	Unicorn-43153.exe
920	Unicorn-49283.exe
2536	Unicorn-12889.exe
2320	Unicorn-35443.exe
2600	Unicorn-56657.exe
2528	Unicorn-27322.exe
2068	Unicorn-53755.exe
656	Unicorn-59885.exe
1768	Unicorn-61483.exe
2936	Unicorn-31499.exe
2872	Unicorn-50596.exe
2656	Unicorn-48951.exe
1084	Unicorn-42821.exe
824	Unicorn-35821.exe
2592	Unicorn-25070.exe
2728	Unicorn-1892.exe
2396	Unicorn-26689.exe
2888	Unicorn-6823.exe

Loads dropped DLL 64 IoCs

pid	Process
2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe
2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe
2288	Unicorn-49307.exe
2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe
2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe
2288	Unicorn-49307.exe
2864	Unicorn-8936.exe
2792	Unicorn-38079.exe
2864	Unicorn-8936.exe
2792	Unicorn-38079.exe
2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe
2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe
2288	Unicorn-49307.exe
2288	Unicorn-49307.exe
2956	Unicorn-13844.exe
2956	Unicorn-13844.exe
2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe
2792	Unicorn-38079.exe
2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe
2792	Unicorn-38079.exe
2288	Unicorn-49307.exe
2288	Unicorn-49307.exe
2776	Unicorn-19975.exe
2776	Unicorn-19975.exe
2864	Unicorn-8936.exe
2864	Unicorn-8936.exe
2132	Unicorn-20167.exe
2132	Unicorn-20167.exe
2376	Unicorn-38501.exe
2376	Unicorn-38501.exe
2956	Unicorn-13844.exe
2956	Unicorn-13844.exe
2324	Unicorn-16253.exe
2324	Unicorn-16253.exe
1580	Unicorn-57084.exe
1580	Unicorn-57084.exe
2792	Unicorn-38079.exe
2792	Unicorn-38079.exe
1052	Unicorn-16348.exe
1052	Unicorn-16348.exe
2776	Unicorn-19975.exe
2776	Unicorn-19975.exe
2880	Unicorn-43820.exe
2880	Unicorn-43820.exe
2864	Unicorn-8936.exe
2864	Unicorn-8936.exe
2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe
2172	Unicorn-10217.exe
2916	Unicorn-30581.exe
2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe
2172	Unicorn-10217.exe
2916	Unicorn-30581.exe
2288	Unicorn-49307.exe
2288	Unicorn-49307.exe
2216	Unicorn-23695.exe
2216	Unicorn-23695.exe
2132	Unicorn-20167.exe
2132	Unicorn-20167.exe
2444	Unicorn-48880.exe
2444	Unicorn-48880.exe
2376	Unicorn-38501.exe
2376	Unicorn-38501.exe
748	Unicorn-41226.exe
748	Unicorn-41226.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31058.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe
2288	Unicorn-49307.exe
2792	Unicorn-38079.exe
2864	Unicorn-8936.exe
2132	Unicorn-20167.exe
2956	Unicorn-13844.exe
2324	Unicorn-16253.exe
2776	Unicorn-19975.exe
2376	Unicorn-38501.exe
1580	Unicorn-57084.exe
2880	Unicorn-43820.exe
1052	Unicorn-16348.exe
2916	Unicorn-30581.exe
2172	Unicorn-10217.exe
2216	Unicorn-23695.exe
2444	Unicorn-48880.exe
748	Unicorn-41226.exe
2404	Unicorn-62346.exe
2036	Unicorn-63348.exe
1712	Unicorn-23585.exe
2088	Unicorn-53323.exe
1184	Unicorn-29716.exe
2076	Unicorn-2969.exe
2328	Unicorn-53544.exe
2544	Unicorn-25357.exe
1036	Unicorn-24131.exe
472	Unicorn-29716.exe
2072	Unicorn-36750.exe
2608	Unicorn-36247.exe
2768	Unicorn-40414.exe
2332	Unicorn-18715.exe
2960	Unicorn-6983.exe
2976	Unicorn-26081.exe
1648	Unicorn-33153.exe
2712	Unicorn-37451.exe
3004	Unicorn-35235.exe
2380	Unicorn-33663.exe
3028	Unicorn-2910.exe
2564	Unicorn-19365.exe
3056	Unicorn-28373.exe
2912	Unicorn-53839.exe
2224	Unicorn-30435.exe
820	Unicorn-39366.exe
1176	Unicorn-7871.exe
2148	Unicorn-29657.exe
1780	Unicorn-29657.exe
2536	Unicorn-12889.exe
2320	Unicorn-35443.exe
920	Unicorn-49283.exe
1148	Unicorn-45946.exe
1920	Unicorn-43153.exe
2600	Unicorn-56657.exe
2528	Unicorn-27322.exe
656	Unicorn-59885.exe
2068	Unicorn-53755.exe
2936	Unicorn-31499.exe
2872	Unicorn-50596.exe
1768	Unicorn-61483.exe
2656	Unicorn-48951.exe
824	Unicorn-35821.exe
1084	Unicorn-42821.exe
2592	Unicorn-25070.exe
1684	Unicorn-32008.exe
2728	Unicorn-1892.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2288	2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe	29
PID 2240 wrote to memory of 2288	2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe	29
PID 2240 wrote to memory of 2288	2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe	29
PID 2240 wrote to memory of 2288	2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe	29
PID 2240 wrote to memory of 2792	2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe	31
PID 2240 wrote to memory of 2792	2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe	31
PID 2240 wrote to memory of 2792	2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe	31
PID 2240 wrote to memory of 2792	2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe	31
PID 2288 wrote to memory of 2864	2288	Unicorn-49307.exe	30
PID 2288 wrote to memory of 2864	2288	Unicorn-49307.exe	30
PID 2288 wrote to memory of 2864	2288	Unicorn-49307.exe	30
PID 2288 wrote to memory of 2864	2288	Unicorn-49307.exe	30
PID 2864 wrote to memory of 2776	2864	Unicorn-8936.exe	33
PID 2864 wrote to memory of 2776	2864	Unicorn-8936.exe	33
PID 2864 wrote to memory of 2776	2864	Unicorn-8936.exe	33
PID 2864 wrote to memory of 2776	2864	Unicorn-8936.exe	33
PID 2792 wrote to memory of 2132	2792	Unicorn-38079.exe	32
PID 2792 wrote to memory of 2132	2792	Unicorn-38079.exe	32
PID 2792 wrote to memory of 2132	2792	Unicorn-38079.exe	32
PID 2792 wrote to memory of 2132	2792	Unicorn-38079.exe	32
PID 2240 wrote to memory of 2956	2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe	34
PID 2240 wrote to memory of 2956	2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe	34
PID 2240 wrote to memory of 2956	2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe	34
PID 2240 wrote to memory of 2956	2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe	34
PID 2288 wrote to memory of 2324	2288	Unicorn-49307.exe	35
PID 2288 wrote to memory of 2324	2288	Unicorn-49307.exe	35
PID 2288 wrote to memory of 2324	2288	Unicorn-49307.exe	35
PID 2288 wrote to memory of 2324	2288	Unicorn-49307.exe	35
PID 2956 wrote to memory of 2376	2956	Unicorn-13844.exe	36
PID 2956 wrote to memory of 2376	2956	Unicorn-13844.exe	36
PID 2956 wrote to memory of 2376	2956	Unicorn-13844.exe	36
PID 2956 wrote to memory of 2376	2956	Unicorn-13844.exe	36
PID 2240 wrote to memory of 2880	2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe	37
PID 2240 wrote to memory of 2880	2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe	37
PID 2240 wrote to memory of 2880	2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe	37
PID 2240 wrote to memory of 2880	2240	4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe	37
PID 2792 wrote to memory of 1580	2792	Unicorn-38079.exe	38
PID 2792 wrote to memory of 1580	2792	Unicorn-38079.exe	38
PID 2792 wrote to memory of 1580	2792	Unicorn-38079.exe	38
PID 2792 wrote to memory of 1580	2792	Unicorn-38079.exe	38
PID 2288 wrote to memory of 2172	2288	Unicorn-49307.exe	39
PID 2288 wrote to memory of 2172	2288	Unicorn-49307.exe	39
PID 2288 wrote to memory of 2172	2288	Unicorn-49307.exe	39
PID 2288 wrote to memory of 2172	2288	Unicorn-49307.exe	39
PID 2776 wrote to memory of 1052	2776	Unicorn-19975.exe	40
PID 2776 wrote to memory of 1052	2776	Unicorn-19975.exe	40
PID 2776 wrote to memory of 1052	2776	Unicorn-19975.exe	40
PID 2776 wrote to memory of 1052	2776	Unicorn-19975.exe	40
PID 2864 wrote to memory of 2916	2864	Unicorn-8936.exe	41
PID 2864 wrote to memory of 2916	2864	Unicorn-8936.exe	41
PID 2864 wrote to memory of 2916	2864	Unicorn-8936.exe	41
PID 2864 wrote to memory of 2916	2864	Unicorn-8936.exe	41
PID 2132 wrote to memory of 2216	2132	Unicorn-20167.exe	42
PID 2132 wrote to memory of 2216	2132	Unicorn-20167.exe	42
PID 2132 wrote to memory of 2216	2132	Unicorn-20167.exe	42
PID 2132 wrote to memory of 2216	2132	Unicorn-20167.exe	42
PID 2376 wrote to memory of 2444	2376	Unicorn-38501.exe	43
PID 2376 wrote to memory of 2444	2376	Unicorn-38501.exe	43
PID 2376 wrote to memory of 2444	2376	Unicorn-38501.exe	43
PID 2376 wrote to memory of 2444	2376	Unicorn-38501.exe	43
PID 2956 wrote to memory of 2404	2956	Unicorn-13844.exe	44
PID 2956 wrote to memory of 2404	2956	Unicorn-13844.exe	44
PID 2956 wrote to memory of 2404	2956	Unicorn-13844.exe	44
PID 2956 wrote to memory of 2404	2956	Unicorn-13844.exe	44

C:\Users\Admin\AppData\Local\Temp\4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe
"C:\Users\Admin\AppData\Local\Temp\4b3737a85d1695ecee13fbd3d69d366d03c6de28d1815d691dd8abf2ccb1e82aN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8936.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19975.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16348.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25357.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe
        8⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32272.exe
        8⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9992.exe
        7⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8267.exe
        7⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7338.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28299.exe
        7⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41133.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        6⤵
        
        PID:1020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47394.exe
        6⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24131.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40512.exe
        7⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17697.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30445.exe
        7⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32299.exe
        7⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8212.exe
        6⤵
        
        PID:624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21769.exe
        6⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43153.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        6⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exe
        5⤵
        
        PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2218.exe
        5⤵
        
        PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        5⤵
        
        PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30581.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29716.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35443.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32008.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37615.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12585.exe
        7⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
        7⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5433.exe
        7⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        6⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32090.exe
        7⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44361.exe
        7⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32374.exe
        7⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53847.exe
        6⤵
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6972.exe
        6⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63730.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56657.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28193.exe
        6⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54579.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57527.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42770.exe
        6⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19769.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43241.exe
        5⤵
        
        PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        5⤵
        
        PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23585.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26689.exe
        6⤵
        Executes dropped EXE
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28270.exe
        7⤵
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21855.exe
        6⤵
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46041.exe
        6⤵
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53575.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63193.exe
        6⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6823.exe
        5⤵
        Executes dropped EXE
        
        PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35591.exe
        5⤵
        
        PID:960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32855.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9527.exe
        5⤵
        
        PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35235.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46706.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17685.exe
        5⤵
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19473.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39193.exe
        5⤵
        
        PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe
      4⤵
      PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8301.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26873.exe
      4⤵
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16253.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27322.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50211.exe
        6⤵
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        6⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
        5⤵
        
        PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        5⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63519.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45858.exe
        5⤵
        
        PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53755.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30734.exe
        5⤵
        
        PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60237.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-463.exe
        5⤵
        
        PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50952.exe
      4⤵
      PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48058.exe
      4⤵
      PID:668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
      4⤵
      PID:3472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29716.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
        5⤵
        
        PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54004.exe
        5⤵
        
        PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38387.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43083.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46781.exe
        5⤵
        
        PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55308.exe
      4⤵
      PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15357.exe
        5⤵
        
        PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24551.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25675.exe
        5⤵
        
        PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe
      4⤵
      PID:752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60588.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5244.exe
      4⤵
      PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21769.exe
      4⤵
      PID:4432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36750.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53839.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37099.exe
        5⤵
        
        PID:1464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54218.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41099.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3195.exe
        6⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63485.exe
        5⤵
        
        PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47674.exe
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40383.exe
        5⤵
        
        PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48754.exe
      4⤵
      PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61569.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
      4⤵
      PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34417.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62918.exe
      4⤵
      PID:4284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30435.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55197.exe
      4⤵
      PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22123.exe
      4⤵
      PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63413.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2188.exe
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
      4⤵
      PID:4668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26602.exe
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48877.exe
    3⤵
    PID:1140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4408.exe
    3⤵
    PID:3324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
    3⤵
    PID:3400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38079.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38079.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23695.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36247.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30370.exe
        7⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56627.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-252.exe
        7⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
        7⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
        6⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21779.exe
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30328.exe
        6⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61483.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        5⤵
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55144.exe
        5⤵
        
        PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47874.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56374.exe
        5⤵
        
        PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18715.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33663.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41721.exe
        6⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32173.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63200.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        5⤵
        
        PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exe
        5⤵
        
        PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19365.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10784.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51798.exe
        5⤵
        
        PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31811.exe
      4⤵
      PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
      4⤵
      PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64999.exe
      4⤵
      PID:4068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57084.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41226.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26081.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49283.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24491.exe
        6⤵
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
        6⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23928.exe
        6⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30207.exe
        6⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59361.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37615.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46041.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13992.exe
        6⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25109.exe
        5⤵
        
        PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59712.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15538.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59590.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        5⤵
        
        PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33153.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19803.exe
        5⤵
        
        PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47450.exe
        5⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46041.exe
        5⤵
        
        PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44152.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22875.exe
        5⤵
        
        PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3506.exe
      4⤵
      PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
      4⤵
      PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51923.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54105.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25863.exe
      4⤵
      PID:4608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17233.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53764.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32855.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16434.exe
      4⤵
      PID:4400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31499.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57035.exe
      4⤵
      PID:4160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38031.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
    3⤵
    PID:1592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36017.exe
    3⤵
    PID:4044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38501.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40414.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30662.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19407.exe
        8⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15836.exe
        8⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        7⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40739.exe
        7⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23507.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46664.exe
        7⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
        6⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39692.exe
        7⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
        7⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62240.exe
        7⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2425.exe
        6⤵
        
        PID:1032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6972.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21769.exe
        6⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5433.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45946.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56157.exe
        6⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29361.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26001.exe
        7⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22123.exe
        6⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46008.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48208.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50027.exe
        5⤵
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41724.exe
        5⤵
        
        PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60613.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9660.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21769.exe
        5⤵
        
        PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25070.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe
        7⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4803.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54723.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
        6⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe
        6⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
        6⤵
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30445.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
        6⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44081.exe
        5⤵
        
        PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59928.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10729.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
        5⤵
        
        PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1892.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe
      4⤵
      PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
      4⤵
      PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65272.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7069.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50596.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
      4⤵
      PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
      4⤵
      PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
      4⤵
      PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6539.exe
      4⤵
      PID:3316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42821.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29593.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29593.exe
    3⤵
    PID:2100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
    3⤵
    PID:2384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31338.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7069.exe
    3⤵
    PID:3348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39366.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51876.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37411.exe
        5⤵
        
        PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45952.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15233.exe
        5⤵
        
        PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
      4⤵
      PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51147.exe
      4⤵
      PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40618.exe
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20462.exe
      4⤵
      PID:3080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37279.exe
      4⤵
      PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
      4⤵
      PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38287.exe
      4⤵
      PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31541.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39436.exe
    3⤵
    PID:2428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57012.exe
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25408.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36599.exe
    3⤵
    PID:3460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2910.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52068.exe
      4⤵
      PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27099.exe
      4⤵
      PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40395.exe
      4⤵
      PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62899.exe
      4⤵
      PID:4988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
    3⤵
    PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe
      4⤵
      PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17005.exe
      4⤵
      PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55529.exe
      4⤵
      PID:4600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5874.exe
    3⤵
    PID:912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
    3⤵
    PID:3892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1245.exe
    3⤵
    PID:4056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10768.exe
    3⤵
    PID:4108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
    3⤵
    PID:2756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29140.exe
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-645.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35486.exe
    3⤵
    PID:4060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30245.exe
    3⤵
    PID:4268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
  2⤵
  PID:1700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
  2⤵
  PID:1672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9251.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9251.exe
  2⤵
  PID:3228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25738.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25738.exe
  2⤵
  PID:3952
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22205.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22205.exe
  2⤵
  PID:3824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe

Filesize
468KB

MD5
d6004de3bd7ae0d1fa13d9b533b14756

SHA1
cadcfb532969ee4f1af695bd694795b57dbea90d

SHA256
a39214280301ff1124a6e88585203cbc5bd0546e3c59fbd549b39589834a8b8c

SHA512
646462ded0c0dcc2db3a3003e5022e9a6fc247c14798241862c1c54d7925e61bdc3241e1cbbf9090914998bf1a7c4582c83e97082bf7866b25fd0a783e337f20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16253.exe

Filesize
468KB

MD5
a301b605dc5b71678b29600132cd9f52

SHA1
056c116b75830b04693463b292800093a5807181

SHA256
1e4121f5673c18abe5c2bd480cc808639de9fc7b257b80139355e2d8262b63b2

SHA512
19f37250b2a04c4bef2d9cfc9d102c893dc71b522985b48063ca7a5cd0ea2ccad2c7b23e1a529e4df06ef260213a5d0f30fc44a4fcaf2e38c8032996cb5ba6f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16348.exe

Filesize
468KB

MD5
e9f69f35e55f8331c979f83e201459f3

SHA1
640eae2148e85d3dd503e038340b826c5a2a7780

SHA256
ae68347fc4b3c4e170089580c28d37acbf8bd40a83e77c8a3f5f0d098aba6184

SHA512
8e6af2b2ebf1b081c4d555f62da54cc566240f40eacb864e4d8532e3213cde69dd97a4dc83291a1130bb400f277529350a1adf176446d406ec53ae28a5ae7721

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38501.exe

Filesize
468KB

MD5
4f9ff59379fc3661e7df7da3fa347ab3

SHA1
d85e88272c0d7de52c18e9e7e0b86415eed36539

SHA256
5161775620f3f3d0b862bb45ce39bc3f61ecb9b16822f8ec4152edda04ee44cc

SHA512
30971c6b2e5acf725fda554fe9b212967bd30c9ec7267dd6614cd076680dc1b7d81a0be485217b8e60d664fa6b51a8efa18b61da7b3c7390d3627ef2f633d3af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe

Filesize
468KB

MD5
2faf5c83dec7cedd07c93aa533d7e090

SHA1
a5419dfae6c195b97443024a86a94fff18809ae6

SHA256
a201d8788fbfacc87cba7b76cc6c63fb316023a96c8150f273a3212a8ff6fba6

SHA512
1d0c544e0fe952f92a6fd6d85497461cc2b832c056342eebc683fee4198c89ecaf4665f89ab673f16d8f0ed5d54788436506c09885ac7dadb521f1db60032da7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe

Filesize
468KB

MD5
0ae62842548076eec3fc6714f55994ae

SHA1
4672eac0fe5de90cfe28209d781cb52679ba80e7

SHA256
82a1c51f1aab15a6c9f16d6d49551207446f72eb7b662cb71c2e62fd20d90c21

SHA512
080bc7c134da6ceb9979d029c4d7ae58847e9498a209133852d491ed84bc9cd41d88125867f7202aa1312129aec3c5450ba96e543bb2770776e58fb2b58b0285

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe

Filesize
468KB

MD5
f3cfdf2387195cfbd8238f94997cbf58

SHA1
dbd24a8b1faa48bb8264d203d713d86573845948

SHA256
2071cfee5cde19581d692b5bd38147b829dcf418c3420fe1f2331e7b80aa9233

SHA512
00eca2b06667307289c7976d04f68e0f567f568bee1faadca8fe6a7a15fbb0b23474f4fb81d613e8830402cca1f09f29a0ff33cfd26e5f96e26721c9f2fbf64e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19975.exe

Filesize
468KB

MD5
898305c62e4c76eed1ff8e80b9449c6b

SHA1
69227a310a908ca8c0232ba4f4d2b1ad88f73cae

SHA256
102d1e837bbb47d9c59ee56f4bfd041523350171d9bb19b3ac251f22654fd48c

SHA512
884af4e8db053a8169ad9d7bafe6672f90f009dc8582fbd2dd1d6c0b63a223fff2d5b63c01b0fe1855bf667f31cbd01727638b8c3d0c5f2d1fd5caebb54afa93

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe

Filesize
468KB

MD5
a1cac7f0568f747b352b7092ec73c5a4

SHA1
8aa5d39b2d59e537df76669bf585f995e219eb64

SHA256
620aceadf21e2166e35ac1384cc11d08762e97c93c781c1dab3bcc8e5dc627d0

SHA512
72d04a33d8905f1ddf43fd942888741a71484e39dc4e3ef52b638166c0cb9053ad2b886086e1ba1a7a21937b15b6fb378f0ba56cf4600c6d32a6cd31843cbf53

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23695.exe

Filesize
468KB

MD5
eeefe77cebb6f7dbe5fd2401c7ddf4c6

SHA1
cc85cea0f5641ac337a58f8da8f6ed2c7269f240

SHA256
dc9386422c392bf8dcf85f0f13ca5b176088af13b866f0bc117f73bae57d46b9

SHA512
3d40bc79b5494b15665a261616bbe72aa761ea2a3243a77345aa899fce6727bda7828d149e2353b4fb46014476312640ff7b45378ae2f81fdb344f92d874edf3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe

Filesize
468KB

MD5
f7f69319ded847fd71387bb08e6328f5

SHA1
454f5b8fb98305cc2aef413e298f9d5e0cd1222b

SHA256
cc96cffd4551ead56cdae5bcb9f06e5d2445571c0c5f4ead7adb50921ba8f771

SHA512
23c3166624ba0e19c4ca6a5b5a932257a42ec736b573bc4b1a5739acce1afecf1a848979017a0441ea21bbe95ee14fff3b7d2f8a50108bc218c0ad5ea3ccd4e7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30581.exe

Filesize
468KB

MD5
cad305d5db035fcebbc02194741e9054

SHA1
2f6d317c7ebafe384d952ccb478b524c7e007330

SHA256
2b1337fca0c40070afc00cd2367832bf355df8f7c46df2ca921114f81996af4c

SHA512
783cce027fab4ce866a9343c3e75f13923d64805adf8d98f4b0eb50174de096f85f2d67703b97da5b0dbcbc442ee5fb95364cf589153486c6eeb0f96d7a5e2bf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38079.exe

Filesize
468KB

MD5
34046971ee00c940d65ceb778999bf29

SHA1
ac361facc49bb9cf8455d6dac5b1c542bea8a78e

SHA256
d64d073f1ebebebe4c0b0adebc790abc9611b9b185a40bace478007d3ace8d45

SHA512
0f09ed8eea7a9b975ce339d2d8f69b24882544c957cfb29cf0457ff8b16e92fe29aea7dc5c9e5774fb05ebca77cbd0063311db01f558ee7389f07b7c4cf75ddb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41226.exe

Filesize
468KB

MD5
9c8849e7013db05f07585302a09f973c

SHA1
b70bedc37c4f3c859f5890717cfa043235f6bb5e

SHA256
bb08db648779562798715c43200da6de7ee9260bc76467bec944ce84c778dfcc

SHA512
2233ddb7ff756c618182332f163a6519b6fa222cb762b18f86712de14f26c93f2a73bd175310ff210ccc1c875a9e8adca58bbc111bff04a28ca9c231d7c2729f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe

Filesize
468KB

MD5
20f1fdf719aa5a867ea92cf643d470c7

SHA1
8d0189d6d42bae59eba639329193584df6429fc3

SHA256
1b0ac04dad2c4501ca4c596ff54ebaf91989e97726e17b729d1232107ec6c85a

SHA512
72c2c4e1b091d78e18bf181f85cc27be823ba2ed7cb7c481aa49bbbcabe9db3f54307c3ed4e1dc06b51e3df09184453ca13d40580d3786d580bb159b85916df1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe

Filesize
468KB

MD5
3ed6e7d652b4e56a46032f6036bf0c51

SHA1
756466b70cb12720d74b17cda8dba40978da9469

SHA256
044e8172647a67a1a8173c13c3f153806c437e910392eaaaff1774162fc9570a

SHA512
1fba07bffd00f0f0a492b9ac3fd75ded5e9cfee31344c5a3cea81bcafd36f919656289155889d3347ed5e2d323994ef9891234140e1972f2c410467355fa3867

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57084.exe

Filesize
468KB

MD5
8a0aeebed080b9d7def158c508ec5ded

SHA1
1e8797409e3d312cca6bb038b848cec9d38d6cc9

SHA256
ca2c306de9c459e670daaf23496324e751a98ac3175867fe6a1e16feaf4b8ef8

SHA512
ee99c1baf2070dc0649b28248c859c43b67770dc632cd1e8143062c1eef4909068a0325848d8edf19adfdffc29b8c021b5e8a9be3dc5a6b3dd4a314e885a6cd8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8936.exe

Filesize
468KB

MD5
40707147032eeb3b339f225e23ffe32b

SHA1
0aaa903fc38814ab07e99c68e1f918572d865ca1

SHA256
fd505e67e6b52d1f103eb4951c190f0bfb0235442f56d75aa03eb7da6f94dc23

SHA512
a3148422df8dc5d533c311d6992e50da3aec23270c396b34edf1b5362f56dae230597c6e935dd1c0d9003138bf95e8d7672ed27225e70c8f84b81661a65abf30

Download Submit
memory/748-359-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/748-357-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/748-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1036-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1052-241-0x0000000001E30000-0x0000000001EA5000-memory.dmp

Filesize
468KB

Download
memory/1052-245-0x0000000001E30000-0x0000000001EA5000-memory.dmp

Filesize
468KB

Download
memory/1052-152-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1184-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1580-224-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/1580-118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1580-367-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/1580-225-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/1648-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2036-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2072-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2076-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-414-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2088-408-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2132-318-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2132-174-0x00000000033F0000-0x0000000003465000-memory.dmp

Filesize
468KB

Download
memory/2132-175-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2132-403-0x00000000033F0000-0x0000000003465000-memory.dmp

Filesize
468KB

Download
memory/2132-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2132-322-0x00000000028C0000-0x0000000002935000-memory.dmp

Filesize
468KB

Download
memory/2172-276-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2172-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-283-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2216-308-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2216-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2216-304-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2240-368-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2240-28-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2240-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-10-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2240-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-275-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2240-281-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2240-11-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2288-130-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2288-139-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2288-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2288-297-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2288-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2288-21-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2324-208-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/2324-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2324-214-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/2328-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-394-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2332-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-347-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2376-190-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2376-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-188-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2380-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2404-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2444-326-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/2444-330-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/2444-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2544-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2564-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2608-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2776-253-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2776-254-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2776-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2776-151-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2776-143-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2792-236-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2792-235-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2792-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2864-269-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2864-153-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2864-387-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2864-270-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2864-161-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2864-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2864-76-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/2880-257-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2880-263-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2880-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-284-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/2916-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-277-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/2956-202-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2956-98-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2956-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2956-203-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2960-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2976-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3004-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3028-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download