cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe
Size

468KB
MD5

7f5a975ecf1590661e95b8cefd95b6c0
SHA1

2bd26a45cb2d357bf9f84b0fc13a29ca3c71e02c
SHA256

cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8
SHA512

240eb065d874070027c440726f2b494d5c614d33a10c2a7837a86db3d9350f8fac7d062036c82349779926bc1e6733711e59fa71aaa67178ec5eb78bb4a2d6fe
SSDEEP

3072:PJvCo3ldI03YtbY2PzkjNfz/rChagIpjn1HCOVLD2WwLCLM2SZlZ:PJ6oMOYtBPAjNfw0g22W6AM2S

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1964	Unicorn-49902.exe
2332	Unicorn-4868.exe
1112	Unicorn-42371.exe
2748	Unicorn-47053.exe
2796	Unicorn-9289.exe
2660	Unicorn-20987.exe
2620	Unicorn-33138.exe
1716	Unicorn-16374.exe
944	Unicorn-3306.exe
2012	Unicorn-35232.exe
2828	Unicorn-59736.exe
1812	Unicorn-5060.exe
2524	Unicorn-54282.exe
1852	Unicorn-897.exe
2724	Unicorn-54017.exe
1776	Unicorn-12948.exe
584	Unicorn-42091.exe
2156	Unicorn-61957.exe
2172	Unicorn-35407.exe
2320	Unicorn-29093.exe
1992	Unicorn-3773.exe
2596	Unicorn-31615.exe
1692	Unicorn-50665.exe
524	Unicorn-9724.exe
1532	Unicorn-49274.exe
1636	Unicorn-25969.exe
2844	Unicorn-48262.exe
2040	Unicorn-17801.exe
2512	Unicorn-6732.exe
1628	Unicorn-15663.exe
2136	Unicorn-53166.exe
1952	Unicorn-48719.exe
1672	Unicorn-21261.exe
2708	Unicorn-24599.exe
2808	Unicorn-14384.exe
2916	Unicorn-26545.exe
1512	Unicorn-33321.exe
2768	Unicorn-10208.exe
2948	Unicorn-49357.exe
2788	Unicorn-50748.exe
2784	Unicorn-18076.exe
2616	Unicorn-32173.exe
2396	Unicorn-49741.exe
1372	Unicorn-59300.exe
1612	Unicorn-59035.exe
1908	Unicorn-18822.exe
1600	Unicorn-38688.exe
2972	Unicorn-61146.exe
2712	Unicorn-28382.exe
2236	Unicorn-40634.exe
2044	Unicorn-20214.exe
916	Unicorn-2050.exe
568	Unicorn-26911.exe
3052	Unicorn-924.exe
3044	Unicorn-53462.exe
864	Unicorn-54831.exe
532	Unicorn-14759.exe
2328	Unicorn-60431.exe
560	Unicorn-41402.exe
816	Unicorn-52839.exe
1552	Unicorn-13773.exe
2036	Unicorn-50208.exe
1904	Unicorn-43794.exe
1608	Unicorn-27479.exe

Loads dropped DLL 64 IoCs

pid	Process
320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe
320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe
1964	Unicorn-49902.exe
320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe
1964	Unicorn-49902.exe
320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe
2332	Unicorn-4868.exe
2332	Unicorn-4868.exe
1964	Unicorn-49902.exe
1964	Unicorn-49902.exe
1112	Unicorn-42371.exe
1112	Unicorn-42371.exe
320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe
320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe
2748	Unicorn-47053.exe
2748	Unicorn-47053.exe
2332	Unicorn-4868.exe
2332	Unicorn-4868.exe
2660	Unicorn-20987.exe
2660	Unicorn-20987.exe
1112	Unicorn-42371.exe
2796	Unicorn-9289.exe
2796	Unicorn-9289.exe
1112	Unicorn-42371.exe
1964	Unicorn-49902.exe
1964	Unicorn-49902.exe
2620	Unicorn-33138.exe
2620	Unicorn-33138.exe
320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe
320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe
1716	Unicorn-16374.exe
1716	Unicorn-16374.exe
2748	Unicorn-47053.exe
2748	Unicorn-47053.exe
944	Unicorn-3306.exe
944	Unicorn-3306.exe
2332	Unicorn-4868.exe
2332	Unicorn-4868.exe
2012	Unicorn-35232.exe
2012	Unicorn-35232.exe
2660	Unicorn-20987.exe
2660	Unicorn-20987.exe
1812	Unicorn-5060.exe
1812	Unicorn-5060.exe
1112	Unicorn-42371.exe
2524	Unicorn-54282.exe
2524	Unicorn-54282.exe
1112	Unicorn-42371.exe
2620	Unicorn-33138.exe
2620	Unicorn-33138.exe
1852	Unicorn-897.exe
1852	Unicorn-897.exe
1964	Unicorn-49902.exe
1964	Unicorn-49902.exe
2724	Unicorn-54017.exe
2724	Unicorn-54017.exe
2828	Unicorn-59736.exe
320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe
2828	Unicorn-59736.exe
320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe
2796	Unicorn-9289.exe
2796	Unicorn-9289.exe
1776	Unicorn-12948.exe
1776	Unicorn-12948.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-924.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7982.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64352.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe
1964	Unicorn-49902.exe
2332	Unicorn-4868.exe
1112	Unicorn-42371.exe
2748	Unicorn-47053.exe
2796	Unicorn-9289.exe
2660	Unicorn-20987.exe
2620	Unicorn-33138.exe
1716	Unicorn-16374.exe
944	Unicorn-3306.exe
2012	Unicorn-35232.exe
1812	Unicorn-5060.exe
2524	Unicorn-54282.exe
2828	Unicorn-59736.exe
2724	Unicorn-54017.exe
1852	Unicorn-897.exe
1776	Unicorn-12948.exe
2156	Unicorn-61957.exe
2172	Unicorn-35407.exe
1992	Unicorn-3773.exe
584	Unicorn-42091.exe
2320	Unicorn-29093.exe
2596	Unicorn-31615.exe
524	Unicorn-9724.exe
1692	Unicorn-50665.exe
2844	Unicorn-48262.exe
1636	Unicorn-25969.exe
1532	Unicorn-49274.exe
2040	Unicorn-17801.exe
1628	Unicorn-15663.exe
2512	Unicorn-6732.exe
2136	Unicorn-53166.exe
1952	Unicorn-48719.exe
1672	Unicorn-21261.exe
2708	Unicorn-24599.exe
2808	Unicorn-14384.exe
2916	Unicorn-26545.exe
1512	Unicorn-33321.exe
2768	Unicorn-10208.exe
2948	Unicorn-49357.exe
2788	Unicorn-50748.exe
2784	Unicorn-18076.exe
2616	Unicorn-32173.exe
2396	Unicorn-49741.exe
1372	Unicorn-59300.exe
1612	Unicorn-59035.exe
1908	Unicorn-18822.exe
1600	Unicorn-38688.exe
2972	Unicorn-61146.exe
2236	Unicorn-40634.exe
2712	Unicorn-28382.exe
568	Unicorn-26911.exe
2044	Unicorn-20214.exe
3052	Unicorn-924.exe
916	Unicorn-2050.exe
3044	Unicorn-53462.exe
864	Unicorn-54831.exe
532	Unicorn-14759.exe
2328	Unicorn-60431.exe
560	Unicorn-41402.exe
816	Unicorn-52839.exe
1552	Unicorn-13773.exe
2036	Unicorn-50208.exe
1460	Unicorn-11142.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 1964	320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe	30
PID 320 wrote to memory of 1964	320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe	30
PID 320 wrote to memory of 1964	320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe	30
PID 320 wrote to memory of 1964	320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe	30
PID 1964 wrote to memory of 2332	1964	Unicorn-49902.exe	31
PID 1964 wrote to memory of 2332	1964	Unicorn-49902.exe	31
PID 1964 wrote to memory of 2332	1964	Unicorn-49902.exe	31
PID 1964 wrote to memory of 2332	1964	Unicorn-49902.exe	31
PID 320 wrote to memory of 1112	320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe	32
PID 320 wrote to memory of 1112	320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe	32
PID 320 wrote to memory of 1112	320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe	32
PID 320 wrote to memory of 1112	320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe	32
PID 2332 wrote to memory of 2748	2332	Unicorn-4868.exe	33
PID 2332 wrote to memory of 2748	2332	Unicorn-4868.exe	33
PID 2332 wrote to memory of 2748	2332	Unicorn-4868.exe	33
PID 2332 wrote to memory of 2748	2332	Unicorn-4868.exe	33
PID 1964 wrote to memory of 2796	1964	Unicorn-49902.exe	34
PID 1964 wrote to memory of 2796	1964	Unicorn-49902.exe	34
PID 1964 wrote to memory of 2796	1964	Unicorn-49902.exe	34
PID 1964 wrote to memory of 2796	1964	Unicorn-49902.exe	34
PID 1112 wrote to memory of 2660	1112	Unicorn-42371.exe	35
PID 1112 wrote to memory of 2660	1112	Unicorn-42371.exe	35
PID 1112 wrote to memory of 2660	1112	Unicorn-42371.exe	35
PID 1112 wrote to memory of 2660	1112	Unicorn-42371.exe	35
PID 320 wrote to memory of 2620	320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe	36
PID 320 wrote to memory of 2620	320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe	36
PID 320 wrote to memory of 2620	320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe	36
PID 320 wrote to memory of 2620	320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe	36
PID 2748 wrote to memory of 1716	2748	Unicorn-47053.exe	37
PID 2748 wrote to memory of 1716	2748	Unicorn-47053.exe	37
PID 2748 wrote to memory of 1716	2748	Unicorn-47053.exe	37
PID 2748 wrote to memory of 1716	2748	Unicorn-47053.exe	37
PID 2332 wrote to memory of 944	2332	Unicorn-4868.exe	38
PID 2332 wrote to memory of 944	2332	Unicorn-4868.exe	38
PID 2332 wrote to memory of 944	2332	Unicorn-4868.exe	38
PID 2332 wrote to memory of 944	2332	Unicorn-4868.exe	38
PID 2660 wrote to memory of 2012	2660	Unicorn-20987.exe	39
PID 2660 wrote to memory of 2012	2660	Unicorn-20987.exe	39
PID 2660 wrote to memory of 2012	2660	Unicorn-20987.exe	39
PID 2660 wrote to memory of 2012	2660	Unicorn-20987.exe	39
PID 2796 wrote to memory of 2828	2796	Unicorn-9289.exe	41
PID 2796 wrote to memory of 2828	2796	Unicorn-9289.exe	41
PID 2796 wrote to memory of 2828	2796	Unicorn-9289.exe	41
PID 2796 wrote to memory of 2828	2796	Unicorn-9289.exe	41
PID 1112 wrote to memory of 1812	1112	Unicorn-42371.exe	40
PID 1112 wrote to memory of 1812	1112	Unicorn-42371.exe	40
PID 1112 wrote to memory of 1812	1112	Unicorn-42371.exe	40
PID 1112 wrote to memory of 1812	1112	Unicorn-42371.exe	40
PID 1964 wrote to memory of 1852	1964	Unicorn-49902.exe	42
PID 1964 wrote to memory of 1852	1964	Unicorn-49902.exe	42
PID 1964 wrote to memory of 1852	1964	Unicorn-49902.exe	42
PID 1964 wrote to memory of 1852	1964	Unicorn-49902.exe	42
PID 2620 wrote to memory of 2524	2620	Unicorn-33138.exe	43
PID 2620 wrote to memory of 2524	2620	Unicorn-33138.exe	43
PID 2620 wrote to memory of 2524	2620	Unicorn-33138.exe	43
PID 2620 wrote to memory of 2524	2620	Unicorn-33138.exe	43
PID 320 wrote to memory of 2724	320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe	44
PID 320 wrote to memory of 2724	320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe	44
PID 320 wrote to memory of 2724	320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe	44
PID 320 wrote to memory of 2724	320	cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe	44
PID 1716 wrote to memory of 1776	1716	Unicorn-16374.exe	45
PID 1716 wrote to memory of 1776	1716	Unicorn-16374.exe	45
PID 1716 wrote to memory of 1776	1716	Unicorn-16374.exe	45
PID 1716 wrote to memory of 1776	1716	Unicorn-16374.exe	45

C:\Users\Admin\AppData\Local\Temp\cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe
"C:\Users\Admin\AppData\Local\Temp\cb7969a84e830e0579a89e467ce25435a696c9c7c6aff1449b547020a249abe8N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49902.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49902.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4868.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4868.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16374.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12948.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exe
        9⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14043.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        9⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4696.exe
        9⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe
        8⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37208.exe
        8⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65504.exe
        8⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52839.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56088.exe
        8⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1490.exe
        8⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26582.exe
        8⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
        8⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37213.exe
        7⤵
        
        PID:300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21474.exe
        7⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50508.exe
        7⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35633.exe
        7⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21261.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11765.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47977.exe
        7⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        7⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        7⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14571.exe
        6⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21090.exe
        6⤵
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4907.exe
        6⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe
        7⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        7⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        7⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        7⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63659.exe
        6⤵
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27778.exe
        6⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65504.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7820.exe
        6⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32173.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe
        6⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        6⤵
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        6⤵
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8317.exe
        6⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59685.exe
        5⤵
        
        PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61811.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
        5⤵
        
        PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61957.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26545.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38024.exe
        7⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        7⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60834.exe
        7⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38578.exe
        6⤵
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7166.exe
        6⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65504.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
        6⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33321.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44547.exe
        6⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39730.exe
        6⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1721.exe
        6⤵
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42055.exe
        6⤵
        
        PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23502.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46086.exe
        6⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        5⤵
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58312.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62422.exe
        6⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12073.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36871.exe
        5⤵
        
        PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35407.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59035.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64967.exe
        5⤵
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35178.exe
        6⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39287.exe
        6⤵
        
        PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60530.exe
        5⤵
        
        PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        5⤵
        
        PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44169.exe
      4⤵
      PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8443.exe
      4⤵
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        5⤵
        
        PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55174.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32797.exe
      4⤵
      PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35736.exe
      4⤵
      PID:5008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9289.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9289.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59736.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58060.exe
        6⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46247.exe
        7⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
        7⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        6⤵
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        6⤵
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50720.exe
        6⤵
        
        PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53161.exe
        5⤵
        
        PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1136.exe
        5⤵
        
        PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65504.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21442.exe
        5⤵
        
        PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53166.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38688.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19934.exe
        6⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50800.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        6⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31562.exe
        5⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-232.exe
        6⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        6⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15225.exe
        5⤵
        
        PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6381.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55836.exe
        5⤵
        
        PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61146.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25964.exe
        5⤵
        
        PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        5⤵
        
        PID:600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33476.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11308.exe
      4⤵
      PID:1472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32954.exe
      4⤵
      PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
      4⤵
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8350.exe
      4⤵
      PID:4364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-897.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25969.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43794.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21972.exe
        5⤵
        
        PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60431.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12136.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55737.exe
        5⤵
        
        PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44395.exe
      4⤵
      PID:684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6892.exe
      4⤵
      PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56730.exe
      4⤵
      PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
      4⤵
      PID:4328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11142.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
      4⤵
      PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8868.exe
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
      4⤵
      PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52937.exe
      4⤵
      PID:4996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6452.exe
    3⤵
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
      4⤵
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
      4⤵
      PID:4940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5106.exe
    3⤵
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6598.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22107.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26601.exe
    3⤵
    PID:4944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42371.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42371.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35232.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29093.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10208.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7982.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        7⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30108.exe
        7⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
        6⤵
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35947.exe
        6⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65504.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53698.exe
        6⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49357.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32762.exe
        6⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        6⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        6⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14571.exe
        5⤵
        
        PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21090.exe
        5⤵
        
        PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe
        5⤵
        
        PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24599.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41402.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-232.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7191.exe
        7⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52642.exe
        6⤵
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48090.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46921.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7820.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7306.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6068.exe
        5⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53467.exe
        5⤵
        
        PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14384.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20702.exe
        5⤵
        
        PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1490.exe
        5⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        5⤵
        
        PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20436.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12425.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
      4⤵
      PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52699.exe
      4⤵
      PID:4148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5060.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31615.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50748.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64967.exe
        6⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6861.exe
        6⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33424.exe
        7⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
        7⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-314.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31185.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14715.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52937.exe
        6⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19035.exe
        5⤵
        
        PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        5⤵
        
        PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65504.exe
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
        5⤵
        
        PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53652.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12676.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17970.exe
      4⤵
      PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21090.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27866.exe
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38091.exe
      4⤵
      PID:4208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9724.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40634.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20702.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55842.exe
        6⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe
        6⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1490.exe
        5⤵
        
        PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41248.exe
        5⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
        5⤵
        
        PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26108.exe
      4⤵
      PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15225.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6381.exe
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7820.exe
      4⤵
      PID:4392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2050.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
      4⤵
      PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
      4⤵
      PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40771.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49379.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61811.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61811.exe
    3⤵
    PID:2292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11225.exe
    3⤵
    PID:4228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33138.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33138.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54282.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59300.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
        7⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15836.exe
        7⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55737.exe
        7⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        6⤵
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8868.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
        6⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41336.exe
        6⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51130.exe
        6⤵
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34694.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41841.exe
        6⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
        5⤵
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43108.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36401.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18822.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42025.exe
        5⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15715.exe
        6⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59530.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        6⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        5⤵
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8868.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43841.exe
        5⤵
        
        PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46009.exe
      4⤵
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25305.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28902.exe
        5⤵
        
        PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
      4⤵
      PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57551.exe
      4⤵
      PID:4440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28382.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59355.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52116.exe
        5⤵
        
        PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15609.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36401.exe
      4⤵
      PID:5028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26911.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11142.exe
      4⤵
      PID:872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
      4⤵
      PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8868.exe
      4⤵
      PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
      4⤵
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52937.exe
      4⤵
      PID:5012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39814.exe
    3⤵
    PID:552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
      4⤵
      PID:1336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17363.exe
      4⤵
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46921.exe
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53698.exe
      4⤵
      PID:4408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29861.exe
    3⤵
    PID:2336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
    3⤵
    PID:3040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57369.exe
    3⤵
    PID:3284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52356.exe
    3⤵
    PID:4348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17801.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20214.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-232.exe
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4861.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38443.exe
      4⤵
      PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15609.exe
      4⤵
      PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59173.exe
      4⤵
      PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53698.exe
      4⤵
      PID:4412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
      4⤵
      Executes dropped EXE
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-232.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46086.exe
        5⤵
        
        PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
      4⤵
      PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8868.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
      4⤵
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13514.exe
      4⤵
      PID:2760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54561.exe
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
    3⤵
    PID:2992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
    3⤵
    PID:3508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18506.exe
    3⤵
    PID:4500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6732.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6732.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53462.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20702.exe
      4⤵
      PID:968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1490.exe
      4⤵
      PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
      4⤵
      PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
      4⤵
      PID:4740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26108.exe
    3⤵
    PID:1488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15225.exe
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32448.exe
    3⤵
    PID:3604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22971.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4448
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54831.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54831.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12341.exe
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
    3⤵
    PID:3304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47275.exe
    3⤵
    PID:3904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58402.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
  2⤵
  PID:2648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56961.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56961.exe
  2⤵
  PID:2316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30503.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30503.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-16374.exe

Filesize
468KB

MD5
873b8ea08266fb48b3f44b93ebd3b9eb

SHA1
98635bb8bdb567a870e08f080ac47922bdbc30cb

SHA256
0b61d3a470be73a8c8b5a3d0485d8900d0b9dc5015648cd64c3b50006968b8a4

SHA512
a71c5350f6ab27e2d34f54b1600c72365bbb29ac12ab6b94ccd9d9d9cabc6ff4362bdc9dc3916553093a76ca16d744f6145d1c4e9cebeb6110e704eb9dca457d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe

Filesize
468KB

MD5
2fb04541b7aca3e27cf01a447e842802

SHA1
7a3e7d25e36651e9ccbc6d866efaa5689c5df541

SHA256
15a77d9382c1e2430bbacab248966f0ef35884fb41cd7981446186abe162df83

SHA512
26a7229dc7caf53f44a9e50b869815ec05547482810c69c70fc9b0f9a54393b64cab317b9627bcfdbabeef5592f39d462d8879777949fe7f0d4a271f66e10cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42371.exe

Filesize
468KB

MD5
57000e3301d04d260fcb0ef821f49b3a

SHA1
35ae6d650e81bf2959025aeed5c4a21f858c7783

SHA256
3f0e2d3983d62e1d499288a70777584c85b5431c563132d4179a4213326d7e2d

SHA512
54a6b5b130df1a6e6b79ff62ef1fa5382bd1dac5192005938d6ebc211b71ec37b927630b35adda36273fdafb1554a9057be47e54e8b8f72b105442bcab4c9bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5060.exe

Filesize
468KB

MD5
509dac457ad6a3dc228021dbc517c119

SHA1
e65060028289676b632eb80d52560195e9396fdf

SHA256
c5d3d5cad0c007e27c4d78019f04c59848f62cc93c7a35b24f2dceab3387fd93

SHA512
6fca5bf27356e6d96e950a20da24b370f2f1f0201fe4602be53d70b03e90eb6c5dca0d6f4e63c09577d0c7717da9457eac6a2e99c99e40dd0660628beb992186

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54282.exe

Filesize
468KB

MD5
f8aa68598b130de80aaa3da765d9aaad

SHA1
d1f08472816e493fddfb4da16edc5dd064e84c3e

SHA256
87d0dc88d8261035a8c82d755ad3f8c95630d641e13fecb0acab9a3244b380dd

SHA512
5be03982b60488dd9fba359f87cdfe4afbf795a8b525ed1cebea367ab86fee94db20957154ace0e7f8f0c19c29eb9cbd0514e52f53720d4e2cc025d96ca04026

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-897.exe

Filesize
468KB

MD5
b065c059d39b5c1f2855ef189266185f

SHA1
40b82e04d462541b8b8feff95e4165ecb39edc19

SHA256
8b86d3ea1a2406cd77b7562d4b0448f4582f410d9d29ea11ea58ddcb1052d86f

SHA512
a8e679eaf185910753389e23dfb952d566a6fbaae0888dd1ac95d3b1b492da2cd4ce3d3d0b2076f648287488fa08b8bb7ce48a383f46acdd42fdbcddbfe38717

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12948.exe

Filesize
468KB

MD5
f3e4d606bfad5cee34384bc53603e2df

SHA1
3fce626e1638ca658cd946872af719f59737030b

SHA256
b71f111e87cacdb523304e928a9db876c441f2117a04eaf5e2fb2893f395a475

SHA512
0b395bde8faf4fb6d845bd32c15ea896fb1509be31d788b240275416d77755517c611710d7487266a789aedc81a7fb8f1e3247ffc3fafe7ded7dc26c1514c3f1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe

Filesize
468KB

MD5
64bac3aebae09d54d2f631f1676a1eab

SHA1
65593b8894a463a818a9062b330c3b1980659d68

SHA256
909368432313ef1e8b580dea514184e6c7d33fb5aca27a19ee7d5b4990f3e4c7

SHA512
a378e3a368f9c230b4bae4fec5dd56c96653c6642aa3f6fbba92aad592a69c8e4d8cdf86eae3ad3f26d9d44cc6a38cc19ae0977a4478eaf838f3449cc5daf828

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33138.exe

Filesize
468KB

MD5
59d3e92ddab4be668c231a4295f86483

SHA1
13aafd19e58f77ff4973953d6a0c19ac1084d19a

SHA256
a69f8431bb186ce977eaeec8de5d1d0a449073bffdcd162d52bdd6951b07bbbb

SHA512
797bc402c25228ae0525d184e0364a4cb751dadb602c407ad2c235b3a8989eb1818ff94ae0e129b3bf290646d3079881df006bd03ee6ad3bcc4d9c35e8af0295

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35232.exe

Filesize
468KB

MD5
3adeada676a908a8c54df823d39f6dbb

SHA1
81cacd0ec94fdd9002ba63186fa737497966b3b8

SHA256
c6c0ccad10b1a8861d813dce696a36da727c02ca90d40c32fc848ca4433827c4

SHA512
7783d3806fdebcdd03441a8bf30403db6c195d0b16bda4eb2eb3732e856f6cda7c70dc2a6317503b92a1f8c350b1333b6474b18785b9c1069c6cb4982906c925

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35407.exe

Filesize
468KB

MD5
22915fc1d0f94c17ff5768267d5229f1

SHA1
995a1ce1828909a58c690e1c90e6acc0372b7b50

SHA256
928c513411eb909c12210528f25caba5d7355ae11755acffb15be123b0b6a608

SHA512
e892f64e344fa48c2844cd5d234095bd602a1b81c20a26bd3a7ebc1be66dc113d9caf1b9c34ef3f446139e62d6c9aa84f74e7a1ba02525bc8432ffb602558ce7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe

Filesize
468KB

MD5
b66676825a48affd08af72d6195dd171

SHA1
ff6021fa9b0abc8fbea52bc0b0c11570c11ec6ab

SHA256
0fb861d8d17ec90d35297b851db9c38591e4887dc8a806d251e681919a5b8248

SHA512
8404104d2b431189469adcade0ce90b0a8e3aab051bfe55e85e41e05e0487d3208019600b705309f729240056181d45e3c2987e070b987537488b44b3a2708c4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe

Filesize
468KB

MD5
3010c110cd121f505a3a6ca68015c460

SHA1
e10fc824a2a0895a3dcf0dfc87d90b32eea08a4e

SHA256
edded0a04ef2b2cdc7a13e112e57b590dc4fde6b98401dd5da5b1c63ea438364

SHA512
f2cc078ff9ff674014a79e3f3611a0bf90dad2408edecb6f4e9a6b57af50b1bf2203d3e6d4ec58755bf14f1126683fde160f4f7764b0df017bc829a946d11b6b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4868.exe

Filesize
468KB

MD5
07cfc314c031084ee12dc2737cb06796

SHA1
ef4e1440f690645268feae9540e15e92fc41d122

SHA256
717645657ab92467810dd0c50ddbc6039bcebdca5da4295ff47a2f23cf34abf9

SHA512
2c65346cd5c042c7d74939e65be9924b59a77569b70a80c6cc78ecbccc2516a73d16297d32b3c94ad26259a484c60973ee0bf7d9218fbb203cc3ad7ae25f7e72

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49902.exe

Filesize
468KB

MD5
94a66a5b7c089475dc03db2c7f40a676

SHA1
274af2378f0d1c0219a7156d48cecccd2920a82f

SHA256
4c426792daf672080bfe0c83e2e8faed0de6f3a08f96bf908161547939d80e75

SHA512
9100508d396d89a65b315024aa43004cb660c65b7219d15a9b7dd99ce761e9e9e14a01bedfcf9cbf6ee4aa749e2cd95890e237812faccc57fa0126a0e358a812

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe

Filesize
468KB

MD5
81c2a3531a1a1ab355d522495d4cb7e1

SHA1
77955888e91b25c537ec8a23bf668a8ce8fe1465

SHA256
211488e5db2fbd86b2d7a68e94838813a9a92e0cbe6978d46328371eaa4d44fe

SHA512
0bcae4f7e167169fa63abdb64deac1422e08a1b77a4e421d0c23b33f3309425ebe4ab20fcfadbd63e2c4b370aa2d9e3cd72269c25c217c7872c33b08449776c7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59736.exe

Filesize
468KB

MD5
9ea9aa54e848d5551a08694db587b7bb

SHA1
1e4b3f8266fd661dc283697ad81523c29be69e2a

SHA256
658a22ef726ed4b5f50e93f99592ffc580dfb04b65a5421fa1c79ef8dc62ac4c

SHA512
82ce781a4bd0f0969aff2e0b1467864264014ad4aeec1401e5a6c2f44842b3f72a9346728488f1609787082f33639dff5b708d01811db5d2111990a68c2da708

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61957.exe

Filesize
468KB

MD5
66f36924bb0f3a391def62c7ab116331

SHA1
6cdd524982bc3f91057ea828322088ce49923718

SHA256
9db5a090406b6125d438afd9462b00b0b18ed40a39f1aaddf7a04ca666f8ad01

SHA512
93c2f51653806b0f50afb77dce8002342c8ac84d43f852e9f3abb3d32185a3505803b7520871d41d1f758737f9bbd079fc8662a63ac2b4e86827f7209e7cc466

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9289.exe

Filesize
468KB

MD5
070527a72d35773176e16c2985559282

SHA1
cac4cac9256a955606bc12868642975a2991f9bd

SHA256
aabd21e1b0b70e20a7dec127f6ec699cbd7e02baeadeb8b3048631ab24382b11

SHA512
ebe4db6e52bf99c2a6c5b5074dab22e90d8489b5a40d7529002ccdc98a5e7cdd80513d65837d3c11394cba63a0e9f9ae68a8ed550f03f5e0055b5266b3711ad8

Download Submit