ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12f

Analysis

max time kernel
119s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe
Size

468KB
MD5

5fe8fb8665df38b9c0d3aed6519bf060
SHA1

ffb2d59ee4e09ac3f9da1afedbe4abf242af72dd
SHA256

ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12f
SHA512

bb31efdb185c441cad3f266644f7416cba0665d12c77111bcb725bd1b7daa6d29a349da3cd92456f84cb883d37c6723580c2d27ae69a81fcb0526f0cac28c38d
SSDEEP

3072:EYaiogIybC5BtbYWPzqjQf8/ECObgnpnnmHhQEhA9sNMMPuHmdEN:EYnok2BtJP+jQfop+Q9syGuHm

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2288	Unicorn-55934.exe
2900	Unicorn-5747.exe
2916	Unicorn-32944.exe
2644	Unicorn-54839.exe
2700	Unicorn-25435.exe
2576	Unicorn-45301.exe
340	Unicorn-8444.exe
1960	Unicorn-6489.exe
1980	Unicorn-60329.exe
2140	Unicorn-47330.exe
2860	Unicorn-43246.exe
3040	Unicorn-54107.exe
2588	Unicorn-18550.exe
968	Unicorn-4251.exe
2072	Unicorn-51725.exe
2580	Unicorn-3365.exe
1744	Unicorn-42814.exe
2388	Unicorn-26500.exe
2260	Unicorn-23192.exe
604	Unicorn-29323.exe
2120	Unicorn-1829.exe
2224	Unicorn-1829.exe
2236	Unicorn-21695.exe
2568	Unicorn-21695.exe
668	Unicorn-21695.exe
2304	Unicorn-27460.exe
1728	Unicorn-7859.exe
996	Unicorn-9250.exe
864	Unicorn-19456.exe
1060	Unicorn-25587.exe
1644	Unicorn-41161.exe
1904	Unicorn-9534.exe
1760	Unicorn-12924.exe
824	Unicorn-56780.exe
2616	Unicorn-56515.exe
1312	Unicorn-56780.exe
852	Unicorn-31314.exe
1120	Unicorn-58103.exe
2952	Unicorn-6209.exe
2780	Unicorn-56594.exe
2800	Unicorn-65524.exe
2828	Unicorn-65524.exe
3032	Unicorn-28576.exe
2792	Unicorn-16878.exe
2672	Unicorn-60983.exe
288	Unicorn-12550.exe
2316	Unicorn-12815.exe
2812	Unicorn-25068.exe
2052	Unicorn-33790.exe
2532	Unicorn-37682.exe
1428	Unicorn-57548.exe
3056	Unicorn-57548.exe
2984	Unicorn-21368.exe
2972	Unicorn-11616.exe
1416	Unicorn-57117.exe
1700	Unicorn-45249.exe
2160	Unicorn-65114.exe
1620	Unicorn-47993.exe
2476	Unicorn-34257.exe
2280	Unicorn-56161.exe
904	Unicorn-28057.exe
2552	Unicorn-28057.exe
336	Unicorn-1314.exe
1816	Unicorn-53116.exe

Loads dropped DLL 64 IoCs

pid	Process
3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe
3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe
3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe
2288	Unicorn-55934.exe
3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe
2288	Unicorn-55934.exe
2900	Unicorn-5747.exe
2900	Unicorn-5747.exe
2288	Unicorn-55934.exe
2916	Unicorn-32944.exe
2288	Unicorn-55934.exe
2916	Unicorn-32944.exe
3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe
3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe
2644	Unicorn-54839.exe
2900	Unicorn-5747.exe
2644	Unicorn-54839.exe
2900	Unicorn-5747.exe
2576	Unicorn-45301.exe
2576	Unicorn-45301.exe
2916	Unicorn-32944.exe
2916	Unicorn-32944.exe
2700	Unicorn-25435.exe
2700	Unicorn-25435.exe
2288	Unicorn-55934.exe
340	Unicorn-8444.exe
2288	Unicorn-55934.exe
340	Unicorn-8444.exe
3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe
3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe
1960	Unicorn-6489.exe
1960	Unicorn-6489.exe
2644	Unicorn-54839.exe
2644	Unicorn-54839.exe
1980	Unicorn-60329.exe
1980	Unicorn-60329.exe
2588	Unicorn-18550.exe
2900	Unicorn-5747.exe
2900	Unicorn-5747.exe
2588	Unicorn-18550.exe
340	Unicorn-8444.exe
2576	Unicorn-45301.exe
2576	Unicorn-45301.exe
340	Unicorn-8444.exe
2860	Unicorn-43246.exe
2140	Unicorn-47330.exe
968	Unicorn-4251.exe
2140	Unicorn-47330.exe
2860	Unicorn-43246.exe
968	Unicorn-4251.exe
2700	Unicorn-25435.exe
2288	Unicorn-55934.exe
2700	Unicorn-25435.exe
2288	Unicorn-55934.exe
3040	Unicorn-54107.exe
3040	Unicorn-54107.exe
2916	Unicorn-32944.exe
2916	Unicorn-32944.exe
2072	Unicorn-51725.exe
2072	Unicorn-51725.exe
3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe
3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe
2644	Unicorn-54839.exe
2644	Unicorn-54839.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52951.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe
2288	Unicorn-55934.exe
2916	Unicorn-32944.exe
2900	Unicorn-5747.exe
2644	Unicorn-54839.exe
2576	Unicorn-45301.exe
2700	Unicorn-25435.exe
340	Unicorn-8444.exe
1960	Unicorn-6489.exe
1980	Unicorn-60329.exe
2860	Unicorn-43246.exe
2588	Unicorn-18550.exe
3040	Unicorn-54107.exe
968	Unicorn-4251.exe
2140	Unicorn-47330.exe
2072	Unicorn-51725.exe
1744	Unicorn-42814.exe
2388	Unicorn-26500.exe
2260	Unicorn-23192.exe
604	Unicorn-29323.exe
2580	Unicorn-3365.exe
2224	Unicorn-1829.exe
2120	Unicorn-1829.exe
2236	Unicorn-21695.exe
2568	Unicorn-21695.exe
668	Unicorn-21695.exe
1728	Unicorn-7859.exe
996	Unicorn-9250.exe
2304	Unicorn-27460.exe
864	Unicorn-19456.exe
1060	Unicorn-25587.exe
1644	Unicorn-41161.exe
1904	Unicorn-9534.exe
2780	Unicorn-56594.exe
1312	Unicorn-56780.exe
852	Unicorn-31314.exe
1760	Unicorn-12924.exe
2616	Unicorn-56515.exe
824	Unicorn-56780.exe
1120	Unicorn-58103.exe
2952	Unicorn-6209.exe
2828	Unicorn-65524.exe
2792	Unicorn-16878.exe
2800	Unicorn-65524.exe
3032	Unicorn-28576.exe
2672	Unicorn-60983.exe
288	Unicorn-12550.exe
2316	Unicorn-12815.exe
2812	Unicorn-25068.exe
2052	Unicorn-33790.exe
3056	Unicorn-57548.exe
2532	Unicorn-37682.exe
1428	Unicorn-57548.exe
2984	Unicorn-21368.exe
2972	Unicorn-11616.exe
1416	Unicorn-57117.exe
1700	Unicorn-45249.exe
2160	Unicorn-65114.exe
1620	Unicorn-47993.exe
2280	Unicorn-56161.exe
2476	Unicorn-34257.exe
904	Unicorn-28057.exe
2552	Unicorn-28057.exe
1816	Unicorn-53116.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2288	3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe	29
PID 3020 wrote to memory of 2288	3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe	29
PID 3020 wrote to memory of 2288	3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe	29
PID 3020 wrote to memory of 2288	3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe	29
PID 3020 wrote to memory of 2916	3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe	30
PID 3020 wrote to memory of 2916	3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe	30
PID 3020 wrote to memory of 2916	3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe	30
PID 3020 wrote to memory of 2916	3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe	30
PID 2288 wrote to memory of 2900	2288	Unicorn-55934.exe	31
PID 2288 wrote to memory of 2900	2288	Unicorn-55934.exe	31
PID 2288 wrote to memory of 2900	2288	Unicorn-55934.exe	31
PID 2288 wrote to memory of 2900	2288	Unicorn-55934.exe	31
PID 2900 wrote to memory of 2644	2900	Unicorn-5747.exe	32
PID 2900 wrote to memory of 2644	2900	Unicorn-5747.exe	32
PID 2900 wrote to memory of 2644	2900	Unicorn-5747.exe	32
PID 2900 wrote to memory of 2644	2900	Unicorn-5747.exe	32
PID 2288 wrote to memory of 2700	2288	Unicorn-55934.exe	33
PID 2288 wrote to memory of 2700	2288	Unicorn-55934.exe	33
PID 2288 wrote to memory of 2700	2288	Unicorn-55934.exe	33
PID 2288 wrote to memory of 2700	2288	Unicorn-55934.exe	33
PID 2916 wrote to memory of 2576	2916	Unicorn-32944.exe	34
PID 2916 wrote to memory of 2576	2916	Unicorn-32944.exe	34
PID 2916 wrote to memory of 2576	2916	Unicorn-32944.exe	34
PID 2916 wrote to memory of 2576	2916	Unicorn-32944.exe	34
PID 3020 wrote to memory of 340	3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe	35
PID 3020 wrote to memory of 340	3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe	35
PID 3020 wrote to memory of 340	3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe	35
PID 3020 wrote to memory of 340	3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe	35
PID 2644 wrote to memory of 1960	2644	Unicorn-54839.exe	36
PID 2644 wrote to memory of 1960	2644	Unicorn-54839.exe	36
PID 2644 wrote to memory of 1960	2644	Unicorn-54839.exe	36
PID 2644 wrote to memory of 1960	2644	Unicorn-54839.exe	36
PID 2900 wrote to memory of 1980	2900	Unicorn-5747.exe	37
PID 2900 wrote to memory of 1980	2900	Unicorn-5747.exe	37
PID 2900 wrote to memory of 1980	2900	Unicorn-5747.exe	37
PID 2900 wrote to memory of 1980	2900	Unicorn-5747.exe	37
PID 2576 wrote to memory of 2140	2576	Unicorn-45301.exe	38
PID 2576 wrote to memory of 2140	2576	Unicorn-45301.exe	38
PID 2576 wrote to memory of 2140	2576	Unicorn-45301.exe	38
PID 2576 wrote to memory of 2140	2576	Unicorn-45301.exe	38
PID 2916 wrote to memory of 3040	2916	Unicorn-32944.exe	39
PID 2916 wrote to memory of 3040	2916	Unicorn-32944.exe	39
PID 2916 wrote to memory of 3040	2916	Unicorn-32944.exe	39
PID 2916 wrote to memory of 3040	2916	Unicorn-32944.exe	39
PID 2700 wrote to memory of 2860	2700	Unicorn-25435.exe	40
PID 2700 wrote to memory of 2860	2700	Unicorn-25435.exe	40
PID 2700 wrote to memory of 2860	2700	Unicorn-25435.exe	40
PID 2700 wrote to memory of 2860	2700	Unicorn-25435.exe	40
PID 2288 wrote to memory of 968	2288	Unicorn-55934.exe	41
PID 2288 wrote to memory of 968	2288	Unicorn-55934.exe	41
PID 2288 wrote to memory of 968	2288	Unicorn-55934.exe	41
PID 2288 wrote to memory of 968	2288	Unicorn-55934.exe	41
PID 340 wrote to memory of 2588	340	Unicorn-8444.exe	42
PID 340 wrote to memory of 2588	340	Unicorn-8444.exe	42
PID 340 wrote to memory of 2588	340	Unicorn-8444.exe	42
PID 340 wrote to memory of 2588	340	Unicorn-8444.exe	42
PID 3020 wrote to memory of 2072	3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe	43
PID 3020 wrote to memory of 2072	3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe	43
PID 3020 wrote to memory of 2072	3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe	43
PID 3020 wrote to memory of 2072	3020	ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe	43
PID 1960 wrote to memory of 2580	1960	Unicorn-6489.exe	44
PID 1960 wrote to memory of 2580	1960	Unicorn-6489.exe	44
PID 1960 wrote to memory of 2580	1960	Unicorn-6489.exe	44
PID 1960 wrote to memory of 2580	1960	Unicorn-6489.exe	44

C:\Users\Admin\AppData\Local\Temp\ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe
"C:\Users\Admin\AppData\Local\Temp\ad483480915a98534e5211fec2a3c2b5c524374324a374229a876d4f8baeb12fN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55934.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55934.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5747.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54839.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6489.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3365.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe
        8⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38715.exe
        8⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56203.exe
        8⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35411.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64704.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19778.exe
        7⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46417.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        7⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11616.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56536.exe
        7⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51632.exe
        7⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13613.exe
        7⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15167.exe
        7⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51100.exe
        7⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
        6⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5695.exe
        6⤵
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64098.exe
        6⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39581.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31967.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42814.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9534.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        7⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        7⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25393.exe
        7⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        7⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33593.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62385.exe
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27475.exe
        7⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62825.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-532.exe
        6⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32650.exe
        6⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48664.exe
        6⤵
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24901.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56011.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5099.exe
        6⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9718.exe
        5⤵
        
        PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7350.exe
        5⤵
        
        PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23123.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27986.exe
        5⤵
        
        PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60329.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12815.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57460.exe
        7⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53407.exe
        7⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25393.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-283.exe
        7⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55877.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60728.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44414.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33790.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36500.exe
        6⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51632.exe
        6⤵
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        6⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21398.exe
        6⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        5⤵
        
        PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53957.exe
        5⤵
        
        PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8530.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9815.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        5⤵
        
        PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23192.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59790.exe
        6⤵
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10781.exe
        6⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
        5⤵
        
        PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
        5⤵
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        5⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64678.exe
        5⤵
        
        PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56515.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49629.exe
        5⤵
        
        PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51632.exe
        5⤵
        
        PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58730.exe
        5⤵
        
        PID:472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28026.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18876.exe
        5⤵
        
        PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52951.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46031.exe
      4⤵
      PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
      4⤵
      PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4390.exe
      4⤵
      PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
      4⤵
      PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34257.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58638.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
        7⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25621.exe
        6⤵
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19421.exe
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50272.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29569.exe
        6⤵
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57486.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55104.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4086.exe
        6⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25621.exe
        5⤵
        
        PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58316.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50272.exe
        5⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        5⤵
        
        PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21368.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
        6⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12146.exe
        7⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23900.exe
        7⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        6⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        6⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3360.exe
        5⤵
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47762.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56110.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49517.exe
        5⤵
        
        PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47993.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe
        5⤵
        
        PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38411.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        5⤵
        
        PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31487.exe
      4⤵
      PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10756.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36867.exe
      4⤵
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
      4⤵
      PID:4732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        6⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32410.exe
        6⤵
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        6⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        6⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35840.exe
        5⤵
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34238.exe
        6⤵
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42135.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
        5⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
        5⤵
        
        PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53116.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exe
        5⤵
        
        PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
        5⤵
        
        PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5519.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
        5⤵
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-511.exe
        5⤵
        
        PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3343.exe
      4⤵
      PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5695.exe
      4⤵
      PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10813.exe
      4⤵
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe
      4⤵
      PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31967.exe
      4⤵
      PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27460.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6209.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34085.exe
        5⤵
        
        PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30024.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27803.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
        5⤵
        
        PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55275.exe
      4⤵
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9536.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59479.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
      4⤵
      PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-532.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe
      4⤵
      PID:4312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56594.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56594.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
      4⤵
      PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7522.exe
      4⤵
      PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21444.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47076.exe
      4⤵
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
      4⤵
      PID:5092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52991.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52991.exe
    3⤵
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62542.exe
    3⤵
    PID:912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51504.exe
    3⤵
    PID:3688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13720.exe
    3⤵
    PID:3992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37889.exe
    3⤵
    PID:3980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32944.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32944.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45301.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47330.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64149.exe
        7⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6043.exe
        7⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40552.exe
        7⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        7⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64704.exe
        6⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19778.exe
        6⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58669.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10092.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45249.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54974.exe
        6⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51632.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1361.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        6⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31436.exe
        6⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28830.exe
        5⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42920.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39551.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31617.exe
        5⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56302.exe
        5⤵
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        5⤵
        
        PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1829.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9821.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43427.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51741.exe
        5⤵
        
        PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
        5⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7154.exe
        6⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17361.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        6⤵
        
        PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23226.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38411.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1314.exe
      4⤵
      Executes dropped EXE
      PID:336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56536.exe
        5⤵
        
        PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51632.exe
        5⤵
        
        PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1361.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34056.exe
        5⤵
        
        PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31436.exe
        5⤵
        
        PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1616.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62567.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47562.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10436.exe
      4⤵
      PID:4972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54107.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9250.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25068.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61627.exe
        6⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        6⤵
        
        PID:828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43070.exe
        6⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8897.exe
        5⤵
        
        PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49052.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34404.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
        5⤵
        
        PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        5⤵
        
        PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        5⤵
        
        PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
      4⤵
      PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47679.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31524.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23469.exe
        5⤵
        
        PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exe
      4⤵
      PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
      4⤵
      PID:4920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19456.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19456.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28576.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        5⤵
        
        PID:832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59245.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        5⤵
        
        PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52369.exe
      4⤵
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51482.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7465.exe
        5⤵
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16976.exe
        5⤵
        
        PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
      4⤵
      PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
      4⤵
      PID:3180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
      4⤵
      PID:4896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12550.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
      4⤵
      PID:1200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
      4⤵
      PID:4136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56781.exe
    3⤵
    PID:2676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7350.exe
    3⤵
    PID:3068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23123.exe
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21764.exe
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27327.exe
    3⤵
    PID:4452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18550.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62203.exe
        6⤵
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35316.exe
        6⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22842.exe
        6⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25621.exe
        5⤵
        
        PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19421.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53403.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15329.exe
        5⤵
        
        PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16878.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
        5⤵
        
        PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        5⤵
        
        PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39496.exe
        5⤵
        
        PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6981.exe
      4⤵
      PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32551.exe
      4⤵
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57404.exe
      4⤵
      PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40026.exe
      4⤵
      PID:4676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1829.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65114.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe
        5⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65358.exe
        5⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21130.exe
        5⤵
        
        PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11886.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52451.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62068.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56161.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14891.exe
      4⤵
      PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55104.exe
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16976.exe
      4⤵
      PID:4380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62567.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exe
      4⤵
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34132.exe
      4⤵
      PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13542.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59815.exe
    3⤵
    PID:3304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25921.exe
    3⤵
    PID:3572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10436.exe
    3⤵
    PID:4980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51725.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51725.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25587.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        5⤵
        
        PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53023.exe
        5⤵
        
        PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6631.exe
        5⤵
        
        PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19504.exe
      4⤵
      PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
      4⤵
      PID:760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53211.exe
      4⤵
      PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
      4⤵
      PID:4468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14196.exe
        5⤵
        
        PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
      4⤵
      PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25393.exe
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15676.exe
      4⤵
      PID:4272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32551.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22593.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22593.exe
    3⤵
    PID:3984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59094.exe
    3⤵
    PID:4584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12924.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31752.exe
      4⤵
      PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9167.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
      4⤵
      PID:4904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58783.exe
    3⤵
    PID:1076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
    3⤵
    PID:3764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe
    3⤵
    PID:3492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
    3⤵
    PID:4740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31314.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31314.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38638.exe
    3⤵
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51632.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58730.exe
    3⤵
    PID:4088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62836.exe
    3⤵
    PID:3844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22960.exe
    3⤵
    PID:4720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
  2⤵
  PID:2928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41566.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41566.exe
  2⤵
  PID:3052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50014.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50014.exe
  2⤵
  PID:3224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3255.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3255.exe
  2⤵
  PID:3580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47102.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47102.exe
  2⤵
  PID:4964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10756.exe

Filesize
468KB

MD5
8bbb795b48c0762ae7d5657b88596617

SHA1
aa09a0e0c402f0f60cbda1d585bc455581b56af4

SHA256
0aeb6ee03188cdd92c9365eaed6438c188e556eed83501e68439cbf999be08ca

SHA512
7c97f8a2f93ce8b7d767806ad80636ba78d76ac664622b26459c51a1c5828d546bc5331c6f1e2a6a63ef3fe0b03d9c37b5a306fcaa2c2184633ed2e6c2348cb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18550.exe

Filesize
468KB

MD5
825b08ccc1372f466c72300133e02617

SHA1
3d43724b91ece64bd5b76728e686b17031d276a3

SHA256
8401e372bb331ddcdb93357e6e379afb560094bbf038f00ed5127de1571a934c

SHA512
e04e47d0eb1889c7da5f29eb9210d70026ffc28b980d36f8e2321e1cf5c20f8ff5525d2423c132949b7d43466d532053a78970c7117ff1d2a97bd87c18247b56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe

Filesize
468KB

MD5
3e63f6c120391d68b0bb781709e1f9a8

SHA1
0d04edae968933e6b045a1dd3bc6c7611352ccba

SHA256
e8bacf981d1b093858b07da4eca04a671c42c3e80c7704688f0000939a132529

SHA512
5f37cdf162cf475ce8e4c5e48bff97d6e109e69c2e6d0ea310bae7a82de035a18bbf66d260992818cf97e77cbb78dca29d94355ddec239fd34ab6249db8a81f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe

Filesize
468KB

MD5
237fd626a3c24691897b7817dbd2dc75

SHA1
741fed01bfbaf654883cc45b5dbf1d9055ddf833

SHA256
b01649b7b821113b579242a89f2aa18f5ef9be7111a0b692395f75e5168973fc

SHA512
5a331ba52885426082100c7bec9edc6cf6b49315f28e46ab4a7a1aedafa9e44d540a1d41bb0cda58bf219da74c685461446983ea4a8d122ac47e720b07119d76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45301.exe

Filesize
468KB

MD5
ebac4d74eec3c96f101476e85309078a

SHA1
c128a4987c4e89b50e35c117d4a13f425cb40d0c

SHA256
236279b1a6ab090a09b7bba9e3b6f78f78882d6b74bc5961f7c6634db85a5602

SHA512
8035b69c1d4b5669f281dfdd32fe378588d883637daf5e5cf1678727ff3b3ef235665b320af039f279d48eb5d04aace634f6cee4ddf5a5eff3e83836c6a249d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5747.exe

Filesize
468KB

MD5
0fcd799eed988ff81d73b18e51e195f9

SHA1
924d0176b0af7b8609367937114792747fe30b8d

SHA256
4f42c501f0f39919a49e90e8840eee11eb7220824ea29333b0b7b05fe4036777

SHA512
546f32026deb09acce8c2bf19c08ff09544489eb683520f5eee4e26caf63d66f94780e09f1027404e7de015775eb700ed0cd56fe6a5a6a19e2e5eedc4463ecf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe

Filesize
468KB

MD5
139732f89b5ffa7f04b806fef9251c48

SHA1
3f2aca1135674d193324422d6860627297059789

SHA256
7390d3d73f7cbf63b2afbe5a1572c557e5ecace6ce835f9689f66cd365a026a6

SHA512
564c2d7bf50452cd010944e6263dd5457400b6f58b364b2364312327f4defe911a46d01645ff4e2a211569e71807d062c789b99eb2eaced48d9ba25d48a155b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe

Filesize
468KB

MD5
4fae6d1ea4e52c0020b7c45864681858

SHA1
41557fe60dd61712e8233b7552a11850e4cac72c

SHA256
6eca754b52a6de2f67db6352ea1c7ec73bd9337d48f74910b63cd7c6f661b676

SHA512
1f2244790b27428e28bb774292185adb7e19e1d6b22e925a5561393298f811c32cb7ee2fa0491888c120b2a76bf76f68e97bd68154ae862f97e22e5f91097c2d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe

Filesize
468KB

MD5
1240c987ab4e406e5c9c6664e88cd46e

SHA1
8201d6a0f01690d398aea140a613cfb7fb28a0d6

SHA256
7b9eab67dc917dab58d541419380bb0126a36668a479dff0910325aca4f97930

SHA512
34c08709f9e779d1a34a3651fe5f7a2904e30bf8a3f648eb511b4a4d5b8bddde0b82e5a9da8e422cc6cc2f86da12cf7296016094903dc5deced8339c61e67fd6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32944.exe

Filesize
468KB

MD5
ca3b20bf47bcd2aa7355cf1a3b1f6218

SHA1
e7516b2daebbd48ee5110e7be1b21fc41b2c667f

SHA256
5758cc427e304abea2192ee22144b250d565fc4affead1dd98f2c00f5bcc74ac

SHA512
875d94f303709ce1187541b1870e074dcdfafe9d47658627188793c034dfdb239603162889df7e8e233243aff809f686d22c2187de70450e77914ccab039a073

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3365.exe

Filesize
468KB

MD5
403312ff1422f0ffdbcbf7b6bfcbc698

SHA1
00b24ca1d3b0d275b83d5b6ce388ac4139701576

SHA256
9c47df752581779ec4db09f25792c8682d5db98351b39121ef1bd7e153834644

SHA512
0056232ab280131c2013ef77bbb25c38fd4454171862481c4bf152f0ac4f4cf40828e0847dfd94a3c635396c47dfa3a706b06b07e8a02394635fa889a6e70e6b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe

Filesize
468KB

MD5
a4a4978173b77df4c491f6229e26d188

SHA1
b0b88f2497901d47c0db142d8654cba13efa6e51

SHA256
856b03d7951717b0a7c14a653d00ed45a306e9606a33f9bd74733dffe6dc9449

SHA512
bf68fdc768541eb65a52933ce142c87b39bd379e53ebae849aaa7a325cf06fe9eb57e6362115380f12629389537003b780425f0c295bc2dd94d4ddfc8808a9fd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42814.exe

Filesize
468KB

MD5
91c84f772e3ee69dfe51288c6b3aaa01

SHA1
e6279e5e39774b33a788dfd0dc8fb59494acbc89

SHA256
0a0732e85e7b09735ca7b752dbf95ecff75aa78434bb92472820127268b36c4c

SHA512
69f964cc0b329b946a30944f75392efd41ed97ca96c86b55d364b4f630307b178081067a6f2a4c33a30efee4ade73a7bbe670afdf8679bb78e796ebc9e3941ff

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47330.exe

Filesize
468KB

MD5
cade1f5bf62015076e4688144d153fae

SHA1
0023e10d443c78e97a209a9db15624c3e3d5cbca

SHA256
9c36d108ee5a4d155b2fdc69f9350bff51f22233afebd63b85544a6ea3deeefd

SHA512
01858cd62a05280fea162f8a726aac8d12a3fc017a0f9802f96ab036f196b13bfa08959eadd1b990041fc2a7d482cec6defe9e4c1a6b876518b6aca1a3a03097

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51725.exe

Filesize
468KB

MD5
93645db414e172d99b0d9af63a909e22

SHA1
b8db9af3f0cc90b62025a92d86cbf7761b08eefb

SHA256
321ebca0f756ba331db477011d7436c02c3d332a8f45b765360bc1990e7cbe85

SHA512
8b07f557c23c42840d9edfeb09862581f10c8a5a57f8295c4bca0577556351cdae4da8626c224d44b17ab7ffd61ab21eaf8c609532c086b604beb10cd2dfe86e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54107.exe

Filesize
468KB

MD5
618b3e04690c6fe797d36637af3b4266

SHA1
5475584c2275aba5ced216bb226da15ede930ff7

SHA256
8fc97864aaaa1251212814ff3c65c77c98bb731182cbb30652e40502757e446b

SHA512
fa00d3db6e9962559e5b031acaef72b9731f2ee557fb62269e5b71e79c8cb7b2467e3495935289980c563e9d9be52a29950b6886acaae90970bb77298665a53e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54839.exe

Filesize
468KB

MD5
6e8a0c2b24894939d1bcc222f20800c0

SHA1
fbf57eb6856b072f3e8a924e7a93d4a14d75f161

SHA256
4d7c76b99ba91275a41213edeb03a60172bcdf3b10fcdbfc9208c6d0774e9005

SHA512
1c5da35cb3413e5821def09ec07e5242be205b49f9ce7efde270d8b84efa94f5c1b880d91d744c74705ad66c8c5f2b04b822de8ce129f1f440933d95198f71f0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55934.exe

Filesize
468KB

MD5
9261bf52e3ea4ac99943fc09191b63e2

SHA1
7cfaf3b03fb6e26698ca379ba57b4ae7baa65abd

SHA256
ccb0cf6ff226452c9dc728e31b065701cecef500f774b901e5dea214233bcae3

SHA512
29e7e1d286b0280b1059632b5071bc072d3b076582b889d8ca4ca9c288435e6d9ee2ad111dcc8dbaa2187426401b0b8ab6b64ef894d58f791a74b9c937a5d032

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60329.exe

Filesize
468KB

MD5
3a47d1c1379203734d8848b22e8b814f

SHA1
f8a96f27c928e80329fbafc780e8733e582d489c

SHA256
052881ecae4ec4dc438f49c17893372ba16cbbec501df32d5f9cb91fdfcd2410

SHA512
bc1caf2f8b51782b9c9744580b28eb5f4a9605591e3bae593d6105d5a26e0c28f79fe31e53f8ac01a3897016c2cc352e181a973ddc247e0f565a825a04d9bc84

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6489.exe

Filesize
468KB

MD5
01ba6968eb78d5c86c111de788ee7bb4

SHA1
21022c1dd805176460c2520672e79f621c35615c

SHA256
bba2f5dd8aac51a5df073936db04d21407d11e7844e691a974606c33070ff625

SHA512
f1cc332200a6ca8a2163b91e72d8d78b5cad0c8b7e02d174d108b07e4902ad898d34a9745b85d0dce709b47bb5858fd09911cdab9b02aa72daa00bc9cdf4390b

Download Submit