f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aee

Analysis

max time kernel
117s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 08:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe
Size

468KB
MD5

1e3febc0ffff084a9c96336e5a569400
SHA1

978633585a0c2b322941b00ee07477ceee9c7336
SHA256

f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aee
SHA512

f8ec6b3c4e65fc21788637ecd129cbea806409725008b2b50e26b733451b69681772c0b3c3b8b24af67e0dbafdbff9ec85c59be4434a43a42b5b35480134f25b
SSDEEP

3072:lGZ3ogIKW05DtbYJHxcOcfr/9Cdlw0p0nLHeapP+UPuLUX/g6cl4:lGBop8DtOHKOcf5YVLUPQa/g6

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2364	Unicorn-12926.exe
2080	Unicorn-31806.exe
2784	Unicorn-27399.exe
1844	Unicorn-58321.exe
2264	Unicorn-8051.exe
2716	Unicorn-26809.exe
2940	Unicorn-37578.exe
3068	Unicorn-47050.exe
2544	Unicorn-28035.exe
2196	Unicorn-15228.exe
2920	Unicorn-7179.exe
2644	Unicorn-53116.exe
2560	Unicorn-42347.exe
2344	Unicorn-7444.exe
684	Unicorn-35321.exe
1516	Unicorn-47102.exe
3004	Unicorn-30966.exe
2184	Unicorn-37289.exe
1548	Unicorn-35679.exe
1612	Unicorn-38447.exe
108	Unicorn-55545.exe
3020	Unicorn-14704.exe
1052	Unicorn-55929.exe
2348	Unicorn-11559.exe
1268	Unicorn-55664.exe
1328	Unicorn-31617.exe
1528	Unicorn-62945.exe
928	Unicorn-65175.exe
2036	Unicorn-51632.exe
2052	Unicorn-43340.exe
236	Unicorn-3660.exe
2124	Unicorn-43615.exe
296	Unicorn-40277.exe
1696	Unicorn-5462.exe
3064	Unicorn-38336.exe
2808	Unicorn-5353.exe
2708	Unicorn-5353.exe
2732	Unicorn-30242.exe
2684	Unicorn-29664.exe
2740	Unicorn-16515.exe
2616	Unicorn-57548.exe
2604	Unicorn-21306.exe
2584	Unicorn-4092.exe
984	Unicorn-50828.exe
2552	Unicorn-23251.exe
3044	Unicorn-10444.exe
1700	Unicorn-63132.exe
2928	Unicorn-1316.exe
1080	Unicorn-46303.exe
2896	Unicorn-10527.exe
2948	Unicorn-59079.exe
2908	Unicorn-25909.exe
2932	Unicorn-53214.exe
1140	Unicorn-59344.exe
2872	Unicorn-59344.exe
3000	Unicorn-16894.exe
2532	Unicorn-35618.exe
1632	Unicorn-35883.exe
1456	Unicorn-36961.exe
3040	Unicorn-60003.exe
772	Unicorn-39457.exe
1292	Unicorn-43558.exe
1284	Unicorn-51540.exe
1800	Unicorn-56817.exe

Loads dropped DLL 64 IoCs

pid	Process
2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe
2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe
2364	Unicorn-12926.exe
2364	Unicorn-12926.exe
2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe
2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe
2784	Unicorn-27399.exe
2080	Unicorn-31806.exe
2784	Unicorn-27399.exe
2364	Unicorn-12926.exe
2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe
2364	Unicorn-12926.exe
2080	Unicorn-31806.exe
2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe
2264	Unicorn-8051.exe
2264	Unicorn-8051.exe
2080	Unicorn-31806.exe
2080	Unicorn-31806.exe
2716	Unicorn-26809.exe
2716	Unicorn-26809.exe
2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe
2784	Unicorn-27399.exe
2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe
2784	Unicorn-27399.exe
2364	Unicorn-12926.exe
2364	Unicorn-12926.exe
2940	Unicorn-37578.exe
2940	Unicorn-37578.exe
1844	Unicorn-58321.exe
1844	Unicorn-58321.exe
2544	Unicorn-28035.exe
2544	Unicorn-28035.exe
2080	Unicorn-31806.exe
2080	Unicorn-31806.exe
3068	Unicorn-47050.exe
3068	Unicorn-47050.exe
2264	Unicorn-8051.exe
2264	Unicorn-8051.exe
2920	Unicorn-7179.exe
2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe
2920	Unicorn-7179.exe
2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe
2560	Unicorn-42347.exe
2560	Unicorn-42347.exe
2196	Unicorn-15228.exe
2196	Unicorn-15228.exe
2364	Unicorn-12926.exe
2364	Unicorn-12926.exe
2716	Unicorn-26809.exe
2716	Unicorn-26809.exe
2644	Unicorn-53116.exe
2644	Unicorn-53116.exe
2344	Unicorn-7444.exe
2344	Unicorn-7444.exe
2784	Unicorn-27399.exe
2784	Unicorn-27399.exe
2940	Unicorn-37578.exe
2940	Unicorn-37578.exe
684	Unicorn-35321.exe
684	Unicorn-35321.exe
1844	Unicorn-58321.exe
1844	Unicorn-58321.exe
1516	Unicorn-47102.exe
1516	Unicorn-47102.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2368	1700	WerFault.exe	75

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20942.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe
2364	Unicorn-12926.exe
2080	Unicorn-31806.exe
2784	Unicorn-27399.exe
2264	Unicorn-8051.exe
2716	Unicorn-26809.exe
1844	Unicorn-58321.exe
2940	Unicorn-37578.exe
3068	Unicorn-47050.exe
2544	Unicorn-28035.exe
2344	Unicorn-7444.exe
2196	Unicorn-15228.exe
2560	Unicorn-42347.exe
2920	Unicorn-7179.exe
2644	Unicorn-53116.exe
684	Unicorn-35321.exe
1516	Unicorn-47102.exe
3004	Unicorn-30966.exe
2184	Unicorn-37289.exe
1548	Unicorn-35679.exe
1612	Unicorn-38447.exe
108	Unicorn-55545.exe
3020	Unicorn-14704.exe
1052	Unicorn-55929.exe
2348	Unicorn-11559.exe
928	Unicorn-65175.exe
1528	Unicorn-62945.exe
1268	Unicorn-55664.exe
1328	Unicorn-31617.exe
2036	Unicorn-51632.exe
236	Unicorn-3660.exe
2052	Unicorn-43340.exe
2124	Unicorn-43615.exe
296	Unicorn-40277.exe
1696	Unicorn-5462.exe
3064	Unicorn-38336.exe
2708	Unicorn-5353.exe
2732	Unicorn-30242.exe
2684	Unicorn-29664.exe
2740	Unicorn-16515.exe
2616	Unicorn-57548.exe
2604	Unicorn-21306.exe
2584	Unicorn-4092.exe
984	Unicorn-50828.exe
2552	Unicorn-23251.exe
3044	Unicorn-10444.exe
1700	Unicorn-63132.exe
2928	Unicorn-1316.exe
1080	Unicorn-46303.exe
2948	Unicorn-59079.exe
2896	Unicorn-10527.exe
2908	Unicorn-25909.exe
2932	Unicorn-53214.exe
1140	Unicorn-59344.exe
2872	Unicorn-59344.exe
2532	Unicorn-35618.exe
1632	Unicorn-35883.exe
3000	Unicorn-16894.exe
1456	Unicorn-36961.exe
3040	Unicorn-60003.exe
772	Unicorn-39457.exe
1292	Unicorn-43558.exe
1284	Unicorn-51540.exe
2024	Unicorn-38679.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2364	2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe	29
PID 2260 wrote to memory of 2364	2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe	29
PID 2260 wrote to memory of 2364	2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe	29
PID 2260 wrote to memory of 2364	2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe	29
PID 2364 wrote to memory of 2080	2364	Unicorn-12926.exe	30
PID 2364 wrote to memory of 2080	2364	Unicorn-12926.exe	30
PID 2364 wrote to memory of 2080	2364	Unicorn-12926.exe	30
PID 2364 wrote to memory of 2080	2364	Unicorn-12926.exe	30
PID 2260 wrote to memory of 2784	2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe	31
PID 2260 wrote to memory of 2784	2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe	31
PID 2260 wrote to memory of 2784	2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe	31
PID 2260 wrote to memory of 2784	2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe	31
PID 2784 wrote to memory of 1844	2784	Unicorn-27399.exe	32
PID 2784 wrote to memory of 1844	2784	Unicorn-27399.exe	32
PID 2784 wrote to memory of 1844	2784	Unicorn-27399.exe	32
PID 2784 wrote to memory of 1844	2784	Unicorn-27399.exe	32
PID 2364 wrote to memory of 2940	2364	Unicorn-12926.exe	34
PID 2364 wrote to memory of 2940	2364	Unicorn-12926.exe	34
PID 2364 wrote to memory of 2940	2364	Unicorn-12926.exe	34
PID 2364 wrote to memory of 2940	2364	Unicorn-12926.exe	34
PID 2080 wrote to memory of 2264	2080	Unicorn-31806.exe	33
PID 2080 wrote to memory of 2264	2080	Unicorn-31806.exe	33
PID 2080 wrote to memory of 2264	2080	Unicorn-31806.exe	33
PID 2080 wrote to memory of 2264	2080	Unicorn-31806.exe	33
PID 2260 wrote to memory of 2716	2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe	35
PID 2260 wrote to memory of 2716	2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe	35
PID 2260 wrote to memory of 2716	2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe	35
PID 2260 wrote to memory of 2716	2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe	35
PID 2264 wrote to memory of 3068	2264	Unicorn-8051.exe	36
PID 2264 wrote to memory of 3068	2264	Unicorn-8051.exe	36
PID 2264 wrote to memory of 3068	2264	Unicorn-8051.exe	36
PID 2264 wrote to memory of 3068	2264	Unicorn-8051.exe	36
PID 2080 wrote to memory of 2544	2080	Unicorn-31806.exe	37
PID 2080 wrote to memory of 2544	2080	Unicorn-31806.exe	37
PID 2080 wrote to memory of 2544	2080	Unicorn-31806.exe	37
PID 2080 wrote to memory of 2544	2080	Unicorn-31806.exe	37
PID 2716 wrote to memory of 2196	2716	Unicorn-26809.exe	38
PID 2716 wrote to memory of 2196	2716	Unicorn-26809.exe	38
PID 2716 wrote to memory of 2196	2716	Unicorn-26809.exe	38
PID 2716 wrote to memory of 2196	2716	Unicorn-26809.exe	38
PID 2260 wrote to memory of 2920	2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe	39
PID 2260 wrote to memory of 2920	2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe	39
PID 2260 wrote to memory of 2920	2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe	39
PID 2260 wrote to memory of 2920	2260	f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe	39
PID 2784 wrote to memory of 2644	2784	Unicorn-27399.exe	40
PID 2784 wrote to memory of 2644	2784	Unicorn-27399.exe	40
PID 2784 wrote to memory of 2644	2784	Unicorn-27399.exe	40
PID 2784 wrote to memory of 2644	2784	Unicorn-27399.exe	40
PID 2364 wrote to memory of 2560	2364	Unicorn-12926.exe	41
PID 2364 wrote to memory of 2560	2364	Unicorn-12926.exe	41
PID 2364 wrote to memory of 2560	2364	Unicorn-12926.exe	41
PID 2364 wrote to memory of 2560	2364	Unicorn-12926.exe	41
PID 2940 wrote to memory of 2344	2940	Unicorn-37578.exe	42
PID 2940 wrote to memory of 2344	2940	Unicorn-37578.exe	42
PID 2940 wrote to memory of 2344	2940	Unicorn-37578.exe	42
PID 2940 wrote to memory of 2344	2940	Unicorn-37578.exe	42
PID 1844 wrote to memory of 684	1844	Unicorn-58321.exe	43
PID 1844 wrote to memory of 684	1844	Unicorn-58321.exe	43
PID 1844 wrote to memory of 684	1844	Unicorn-58321.exe	43
PID 1844 wrote to memory of 684	1844	Unicorn-58321.exe	43
PID 2544 wrote to memory of 1516	2544	Unicorn-28035.exe	44
PID 2544 wrote to memory of 1516	2544	Unicorn-28035.exe	44
PID 2544 wrote to memory of 1516	2544	Unicorn-28035.exe	44
PID 2544 wrote to memory of 1516	2544	Unicorn-28035.exe	44

C:\Users\Admin\AppData\Local\Temp\f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe
"C:\Users\Admin\AppData\Local\Temp\f1aaa35a195621cd7e1835b943389f930eaebdb1003227be29ccc2bc52953aeeN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12926.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12926.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31806.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8051.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47050.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37289.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30242.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49701.exe
        8⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        8⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45926.exe
        8⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2105.exe
        7⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2217.exe
        7⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10663.exe
        7⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55015.exe
        7⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41749.exe
        7⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41223.exe
        7⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45088.exe
        8⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        8⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23173.exe
        8⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37800.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45290.exe
        7⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
        7⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39971.exe
        7⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        6⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        6⤵
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23775.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
        6⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5462.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        7⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39767.exe
        7⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-426.exe
        7⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        7⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3288.exe
        6⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        6⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32441.exe
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37980.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe
        6⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38336.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10278.exe
        6⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37800.exe
        6⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49099.exe
        6⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31633.exe
        5⤵
        
        PID:616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
        6⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50703.exe
        5⤵
        
        PID:276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe
        5⤵
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33515.exe
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11142.exe
        5⤵
        
        PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28035.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47102.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43615.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60055.exe
        7⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39767.exe
        7⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-426.exe
        7⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        7⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
        6⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16432.exe
        7⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37700.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        7⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6143.exe
        7⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32441.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47288.exe
        6⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40277.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42868.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        7⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe
        7⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24183.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5812.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37477.exe
        7⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        6⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        6⤵
        
        PID:112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
        6⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61818.exe
        5⤵
        
        PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59368.exe
        5⤵
        
        PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40496.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40509.exe
        5⤵
        
        PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30966.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21306.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
        6⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
        6⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20527.exe
        5⤵
        
        PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        5⤵
        
        PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37949.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63280.exe
        5⤵
        
        PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50828.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43558.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53939.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        6⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18249.exe
        5⤵
        
        PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2735.exe
        5⤵
        
        PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37506.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23168.exe
        5⤵
        
        PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51540.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57227.exe
        5⤵
        
        PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
        5⤵
        
        PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39979.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62426.exe
      4⤵
      PID:316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-465.exe
      4⤵
      PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65209.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14480.exe
      4⤵
      PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
      4⤵
      PID:4208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1316.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50237.exe
        7⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
        7⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33949.exe
        7⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54658.exe
        7⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22670.exe
        6⤵
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8430.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15837.exe
        6⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
        6⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46303.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17392.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10448.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
        6⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        5⤵
        
        PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38139.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        5⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52802.exe
        5⤵
        
        PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51632.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10527.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        6⤵
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60583.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51791.exe
        6⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47464.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34898.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53214.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13269.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4499.exe
        5⤵
        
        PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14554.exe
      4⤵
      PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7501.exe
      4⤵
      PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4848.exe
      4⤵
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38710.exe
      4⤵
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
      4⤵
      PID:4896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42347.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42347.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5353.exe
        5⤵
        Executes dropped EXE
        
        PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16894.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11407.exe
        6⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13269.exe
        5⤵
        
        PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe
        5⤵
        
        PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16515.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60003.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24057.exe
        6⤵
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40203.exe
        6⤵
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        6⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        5⤵
        
        PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        5⤵
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        5⤵
        
        PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        5⤵
        
        PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39457.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        5⤵
        
        PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe
        5⤵
        
        PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59491.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        5⤵
        
        PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe
      4⤵
      PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32498.exe
      4⤵
      PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30433.exe
      4⤵
      PID:4908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55664.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55664.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59344.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14911.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49515.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16970.exe
      4⤵
      PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54174.exe
      4⤵
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30433.exe
      4⤵
      PID:4948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25909.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
      4⤵
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
      4⤵
      PID:2772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61531.exe
    3⤵
    PID:2328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34648.exe
    3⤵
    PID:3116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-383.exe
    3⤵
    PID:3256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61730.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
    3⤵
    PID:4740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27399.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27399.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58321.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58321.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43340.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        6⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39767.exe
        6⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-426.exe
        6⤵
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        6⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63824.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe
        5⤵
        
        PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        5⤵
        
        PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21440.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16112.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
        5⤵
        
        PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59344.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-90.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-90.exe
        6⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37197.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54234.exe
        6⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43010.exe
        5⤵
        
        PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53446.exe
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        5⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30179.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47051.exe
        5⤵
        
        PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
        5⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        6⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11090.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        5⤵
        
        PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53689.exe
      4⤵
      PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48936.exe
      4⤵
      PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21202.exe
      4⤵
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19815.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37488.exe
      4⤵
      PID:4196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53116.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31617.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17705.exe
        5⤵
        
        PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2611.exe
        5⤵
        
        PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41599.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37949.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63280.exe
        5⤵
        
        PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6474.exe
      4⤵
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21563.exe
        5⤵
        
        PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        5⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        5⤵
        
        PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
      4⤵
      PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32996.exe
      4⤵
      PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21383.exe
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30433.exe
      4⤵
      PID:4916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65175.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38679.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10.exe
      4⤵
      PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47464.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
      4⤵
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe
      4⤵
      PID:2492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35618.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49265.exe
      4⤵
      PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13269.exe
      4⤵
      PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53351.exe
      4⤵
      PID:4116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62747.exe
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30623.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32903.exe
    3⤵
    PID:3104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30433.exe
    3⤵
    PID:4924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15228.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4092.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24057.exe
        6⤵
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40203.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24183.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15049.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        6⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        5⤵
        
        PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53939.exe
        5⤵
        
        PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
        5⤵
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37949.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63280.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56817.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43451.exe
        5⤵
        
        PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41599.exe
        5⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41038.exe
        5⤵
        
        PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60823.exe
        5⤵
        
        PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60007.exe
      4⤵
      PID:360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10790.exe
        5⤵
        
        PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9270.exe
        5⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
        5⤵
        
        PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22404.exe
      4⤵
      PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47159.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47563.exe
      4⤵
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10644.exe
      4⤵
      PID:3384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11559.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35883.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45088.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7605.exe
        5⤵
        
        PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35475.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49959.exe
      4⤵
      PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45964.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36961.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9894.exe
      4⤵
      PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37800.exe
      4⤵
      PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45290.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32647.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43066.exe
      4⤵
      PID:4980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50703.exe
    3⤵
    PID:2452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
    3⤵
    PID:4036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41346.exe
    3⤵
    PID:3352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44634.exe
    3⤵
    PID:4468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7179.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7179.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55545.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10444.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2611.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41599.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47033.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
      4⤵
      PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53939.exe
      4⤵
      PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27198.exe
      4⤵
      PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe
      4⤵
      PID:4832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1700
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 200
      4⤵
      Program crash
      PID:2368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21821.exe
      4⤵
      PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32996.exe
    3⤵
    PID:2096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21383.exe
    3⤵
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46148.exe
    3⤵
    PID:3492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38447.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38447.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5353.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63802.exe
      4⤵
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48764.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20486.exe
        5⤵
        
        PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39767.exe
      4⤵
      PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-426.exe
      4⤵
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
      4⤵
      PID:4880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
    3⤵
    PID:3012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
    3⤵
    PID:4052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
    3⤵
    PID:2188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39587.exe
    3⤵
    PID:4504
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29664.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29664.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25956.exe
    3⤵
    PID:2880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39767.exe
    3⤵
    PID:2192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-426.exe
    3⤵
    PID:3108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
    3⤵
    PID:3144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22260.exe
    3⤵
    PID:2820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26959.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26959.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29702.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29702.exe
  2⤵
  PID:2520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
  2⤵
  PID:3960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18680.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18680.exe
  2⤵
  PID:3808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55369.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55369.exe
  2⤵
  PID:4252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-15228.exe

Filesize
468KB

MD5
37e3be920efbef3e84c993d0b58b6d8e

SHA1
cc68cfe63e76a66fb14e7e36d24f15100e159dfd

SHA256
a1559ad306682e78a97a6fd349fd5b3871f891838273c7fcfcc6e141f7f2b1e0

SHA512
cfcc5f40b09c2f69dceded3a1579efd61635685e7b88ad68beb88e302c1fb5fc03ba937192405f3c72b63c37b4fff2c4bc369d4dc53ef992b778c2977df28dad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31617.exe

Filesize
468KB

MD5
91f5af4c4764a69881fafb850a8270ac

SHA1
e6090b5b3f25d408c46a152033b5476b73daee5c

SHA256
1745b1c469f4f2e1d7491049488744722d71be4180baf90af3e0ae46101cf62d

SHA512
acbf480d4e4751bb508725532afa34f8fae2d88ea4cc28242bacbc7e5e78873222efeda31983a7d4b35362dec0cf47ff81b81599ed7c4f9e8ab2775d5c70a710

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31806.exe

Filesize
468KB

MD5
0717a7b0d1e5bf47bdd30ae51943bd26

SHA1
487b02e781a03fd28830686a4240e36cb5b98ff1

SHA256
aa6d2b344a152db4d82471a45441d17cd8c38c73a24b09c7b2bf0eff5b1a8f8c

SHA512
0a1857e4fe3de6a6381017066cf104bc4178bdbc609f07d58f1fc48f2dda4e07f6145ff7c5e598cebcc8883bf2c0478ed5658e1dded03999769407863e5df918

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42347.exe

Filesize
468KB

MD5
33b7c4a00605f6fc11786dcb06a67a14

SHA1
a6a9ead5e622bdcda491daaee113e454d0ae0074

SHA256
f2a373ec761319abab3176318111d452c771a4f54725e91ea6d5953d030367a4

SHA512
5ab75ed14c4b17d4e57abf425e3031876c76395768ed3a518678f656b6595ec548341bf5f0905cb0328861e436c4048f7c5b05ca6c5a1dbe30c2c91fa9b3af67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53116.exe

Filesize
468KB

MD5
bbddb9baf24064c07fdecbf4b20434d9

SHA1
6c577e1d4526acf6aa5b00e80f036760bfc730c8

SHA256
83236d2502ebf63c5098b0b8df1db1bdd888d711e08ddbd6f19a6517858ea4ee

SHA512
16b300a89c3a577f44cb6e82471eb4a1ae7fa1703f2d8a43f8958f299daac395dd9a0b0adc661eef805ac4b9ea058b456eb8b2026018509b3c2f7c9e7b48f6ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53939.exe

Filesize
468KB

MD5
c72efa6bc0b97399addfcd34068e0954

SHA1
667f122c6d6514b59da1400dc50b0aa9bc8bd4b2

SHA256
3094ea0c95aebe87a0e881b873cf70082711b5d91555053984b320e49d00d941

SHA512
a2ab1df619459cd85cdf06e9201050bc19f8e2b44fef749f3d021ddb3bbd0349aa319f39f7c62886c4adf1939d5379e80ac750b8763a8b225ee92645147c3a13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58321.exe

Filesize
468KB

MD5
c64921d55338ba22d791c2087368134e

SHA1
fd9eee7a8d3fb657abe8cd1d3b6aab86d96ced89

SHA256
f3279373086f64edbb189e06eb3541b2b735075db70e39ce485e95e293c1f79b

SHA512
aff500a8201e7a1f6520754ab35a0e4d09869247126f26e3973bf1cd17f2d40bfb28d966a4bd1360d1d72e6fbcb8caa2401b29ee72e2f0f995416efda5181167

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7179.exe

Filesize
468KB

MD5
372413c0ea566755f4d0498961c07778

SHA1
84cd846528df2d690b1b7608b71cf538e416733c

SHA256
acacd74acbb762783aab777e5d3d4de6f25a99685be5b85991544b6b0e287436

SHA512
94b7e784d5cdc63d050d69f25fe397fd4534bcf8f078c59a6c09a2ce0cf26806167783ecd8bfa5daab86b27b0f57f54e7f5e78c5704ee575d8960ae3f4c1bed8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12926.exe

Filesize
468KB

MD5
2cc9fbf67b12efeab35e7dd7602ad898

SHA1
ea43bfe26518a35123b4730fbac90d4d9a94d214

SHA256
e5b1b68a3cad25ee7733b97c606ce0dd6768ef985c15d329fa59662a2af97408

SHA512
bd9821423bb6042f89df2ca61f3903723af37456790647b2364e35447ed1280470bcad999ab599bd751eea7b1ede14a4c444ea3295570f4d4ed09cf8169f767d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe

Filesize
468KB

MD5
1af980c5620b28ef31c14afd62653f51

SHA1
050942fcda45d84fd09a100f13cb2a721568c007

SHA256
3fb2c234a7f4052a50bb2c80c50c93c190141df9f04e0b2a06ab95b07f61f626

SHA512
32bc9c337b02857c365d8b525b93ab19a37b223fe7ae7f23dcf5a16e7770b822c743911757449d3afd4ecdd43fa367e171abeaff6d35605c00574fd675891392

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27399.exe

Filesize
468KB

MD5
c3068c7d8ecd69988f5a780fff89a921

SHA1
e564b11952c02a41c6e78ba5bfc7db68a2e375e8

SHA256
fa8934635b1ae3d36930fc586e8b8a4270a2e20acdc959ae88008e15a70078c3

SHA512
e922d15c710b4940b7f26369f5b163fe94df66c7f30bbaf31925a0adad833d222eafe7a07a759d162d7618ae873dfb6c0a34e62be49ee8540ad177d602b9bd7a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28035.exe

Filesize
468KB

MD5
028a63c2139feebaa57d78cbcd7a3996

SHA1
af45cac4ab289dd331eb47947078668c3b364d33

SHA256
b1a52de301e7c93b9dfab51e7cba7e587ee4ea90543a685963c9fcf3ec9d8629

SHA512
69a7643b8c439ea885a8d146f4cfd36078cc2a19d4f189ef3774faa879d8326ce5cbd4790f99ad11309972cf3615342a33bf1e6c0a4cb0efee1480197cac1558

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30966.exe

Filesize
468KB

MD5
fd04b157cb766c652d7dd260798ecbf1

SHA1
afeefe05e7b3c36a4d8b8799f4fd0c8c7a00b4cf

SHA256
d3bfcb5b26333a8a44d97b5e9262f87e122c35790d06979f5b3dc141d1704148

SHA512
7ebeae91d9558ebcffc1c75efef47db2efddc08e86fd8661b8dce2eb8268fcc8bc4ff24e33ec6ffc271cfce904127174c8ffdf704ada80ae1f5468e84d7b7423

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe

Filesize
468KB

MD5
6c34b84414a2852462e2c4eb57b81f29

SHA1
d583bf459fa7d522fafd68175d770f79abfe6a10

SHA256
47d41d266391f9d53fb3503d4f45cb825c074150adfd7c7d64f574b770c61698

SHA512
7432e01d0ebd79290b8691bcd8d4a9f0e6f6637dcbf3ef5a11949a1e3c3c6972153dae94c421c48610a4728067d98ec9b6d6ce41934746b02b4cedb45220e6f6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37289.exe

Filesize
468KB

MD5
5263979b9537cf6da87ad87f5f470737

SHA1
52f0a4212a84469a0eafa4e98307c573e06d2421

SHA256
566ca26d6e79fea676a02a62147311ef67ae0a2d169c9fe9c55ce94765460cbf

SHA512
f0b0ce4a103159489f524c2c07b36efad5c326dc77daa92d7d750a05a179eca27bb0a6e8d0580a454dcc2c036f88e7029f2423659903eaef62b0e02ae4d2be90

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe

Filesize
468KB

MD5
633eaf14209d583e863f573f24bfa2ef

SHA1
00d22ba2b7dfb552c7d1a0a9c25454107b6800c8

SHA256
5bc201f447e297a037b0a599843e6e9024e87dad8f8c845132e3130b5251a56e

SHA512
90be7370197c2a131a2a92b4d2893114ad45d8c0fc1d3140ab09297b42e59d09efb797c89af836994a1936a762d8fcbf4be8e765d3ce595229be09f550691407

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47050.exe

Filesize
468KB

MD5
9d0c06670d70da3d67177739e73dbf45

SHA1
e063a8c74bfd5893ab67d503358d4815ebe6fb64

SHA256
d6955906ffc872927974a41c82cc45694e38e064438df18a1137d2123708ff7b

SHA512
c4bcb38a709217388ca4b0171e9d304f5a6d3a92cac9bd7a036ff28422b4508e2ee86edd5a90b54ca28166ad62e405daca36b1c5e7f1c92a5467cf9bf7b441d1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47102.exe

Filesize
468KB

MD5
b31ab5ec79d9dde93322e3a548fbd3df

SHA1
c3ed4c69d161c9b4d9816668e18600caf0afb5a9

SHA256
e41cc6da48f0bed300a0b0738e6c22ad7147515adb1ae8e79a41bed144ecaacd

SHA512
eecfd3ac5c2dc12290dc276818015e06c4668ce2cbac346f3cf383ffad2fd16f3390bcb3f7079ec5663ff0b174a7514a06cf2bb875e609ede229a527014ac256

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe

Filesize
468KB

MD5
39247e95ccb38acf1b6bc8ce62ef2745

SHA1
aad399525dcdd7bfe28fcdd553a3819d72a0f13f

SHA256
47f58864ac9a70cc71d578d9fa8d9242736a48291119546adf2149b0a3ffce8a

SHA512
7a40b923f5e84c5395742b1ba84f5116bb84d9cc8e96f55edd956b32ac479f4f5372dfbb54a0caa98bea68b9f08d3a1b0507303ba7b12bbdc39814bdfe1c7afd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8051.exe

Filesize
468KB

MD5
a717b033003bbccb49bcd7fbd2e7b36f

SHA1
c4da746fdcc9320a7d84f392db71362832eaffae

SHA256
bc1d8bd7bd8831a2f065ad6695b8e90695f036ef285fefd2cba6ff191afb0b6a

SHA512
5639be93fadc5b0207b5d6ea106c0a84f40067bc45df065f90f683e0a964a609c3477fc7e5c5c13e36b7341a4119abfca543fc01b4c05d3231d61adab38fcd49

Download Submit