52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe
Size

468KB
MD5

cf82db6aa2905ad26e38ab09aae74056
SHA1

46d929859e16ca7fee376db4e9f0e28d2b988b9d
SHA256

52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8
SHA512

23cc04a8ad609347501b643c302bb1022559fd675fb2bf4dabbc0b0ddbd83412722948f9373ddcdcb6cf75010ac9b6d8d3b59b83d794e9289a3a9ef318fd83ce
SSDEEP

3072:4JelogxAIU573rYZPzcfmbfD/82DnsIHzQmyeQVBAf4uktiduxulWl:4J4oYc73SP4fmbfCa5Nf4/Idux5

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2892	Unicorn-32539.exe
2840	Unicorn-58195.exe
2820	Unicorn-28023.exe
2928	Unicorn-54770.exe
2148	Unicorn-47157.exe
2776	Unicorn-36296.exe
2708	Unicorn-21997.exe
2692	Unicorn-22049.exe
2252	Unicorn-63444.exe
2108	Unicorn-55297.exe
3036	Unicorn-12218.exe
3040	Unicorn-44726.exe
2300	Unicorn-2012.exe
3028	Unicorn-47684.exe
2328	Unicorn-12894.exe
1744	Unicorn-9365.exe
2272	Unicorn-43682.exe
2096	Unicorn-14347.exe
2684	Unicorn-35322.exe
1968	Unicorn-6655.exe
1408	Unicorn-63932.exe
1848	Unicorn-33206.exe
2604	Unicorn-33105.exe
1244	Unicorn-65116.exe
288	Unicorn-4425.exe
1816	Unicorn-51488.exe
2556	Unicorn-10190.exe
1736	Unicorn-54757.exe
1560	Unicorn-36112.exe
2268	Unicorn-40750.exe
2324	Unicorn-52448.exe
1472	Unicorn-62654.exe
1620	Unicorn-56916.exe
1608	Unicorn-36396.exe
1184	Unicorn-54778.exe
2856	Unicorn-4508.exe
2932	Unicorn-4243.exe
2312	Unicorn-7777.exe
1048	Unicorn-35811.exe
2848	Unicorn-24742.exe
2732	Unicorn-33673.exe
2904	Unicorn-13152.exe
3032	Unicorn-13060.exe
1352	Unicorn-35619.exe
2416	Unicorn-9644.exe
2508	Unicorn-51140.exe
2640	Unicorn-5468.exe
1100	Unicorn-3885.exe
2968	Unicorn-36003.exe
1984	Unicorn-54861.exe
1260	Unicorn-13828.exe
436	Unicorn-29395.exe
2024	Unicorn-13828.exe
2016	Unicorn-13828.exe
2188	Unicorn-6215.exe
2240	Unicorn-13563.exe
1612	Unicorn-13563.exe
2228	Unicorn-46593.exe
2404	Unicorn-2152.exe
1124	Unicorn-46315.exe
1636	Unicorn-49023.exe
972	Unicorn-26465.exe
2164	Unicorn-953.exe
1624	Unicorn-3968.exe

Loads dropped DLL 64 IoCs

pid	Process
392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe
392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe
392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe
2892	Unicorn-32539.exe
2892	Unicorn-32539.exe
392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe
2840	Unicorn-58195.exe
2892	Unicorn-32539.exe
2892	Unicorn-32539.exe
2840	Unicorn-58195.exe
2820	Unicorn-28023.exe
392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe
392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe
2820	Unicorn-28023.exe
2928	Unicorn-54770.exe
2928	Unicorn-54770.exe
2840	Unicorn-58195.exe
2840	Unicorn-58195.exe
2776	Unicorn-36296.exe
2776	Unicorn-36296.exe
392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe
392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe
2892	Unicorn-32539.exe
2892	Unicorn-32539.exe
2708	Unicorn-21997.exe
2708	Unicorn-21997.exe
2820	Unicorn-28023.exe
2820	Unicorn-28023.exe
2692	Unicorn-22049.exe
2692	Unicorn-22049.exe
2928	Unicorn-54770.exe
2928	Unicorn-54770.exe
2148	Unicorn-47157.exe
2148	Unicorn-47157.exe
2108	Unicorn-55297.exe
2108	Unicorn-55297.exe
2776	Unicorn-36296.exe
2776	Unicorn-36296.exe
2840	Unicorn-58195.exe
2840	Unicorn-58195.exe
3040	Unicorn-44726.exe
3040	Unicorn-44726.exe
3028	Unicorn-47684.exe
3028	Unicorn-47684.exe
2820	Unicorn-28023.exe
2820	Unicorn-28023.exe
392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe
392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe
3036	Unicorn-12218.exe
3036	Unicorn-12218.exe
2300	Unicorn-2012.exe
2300	Unicorn-2012.exe
2892	Unicorn-32539.exe
2892	Unicorn-32539.exe
2708	Unicorn-21997.exe
2708	Unicorn-21997.exe
2328	Unicorn-12894.exe
2328	Unicorn-12894.exe
2692	Unicorn-22049.exe
2692	Unicorn-22049.exe
1744	Unicorn-9365.exe
1744	Unicorn-9365.exe
2928	Unicorn-54770.exe
2928	Unicorn-54770.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51243.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58037.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50793.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4243.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54374.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe
2892	Unicorn-32539.exe
2840	Unicorn-58195.exe
2820	Unicorn-28023.exe
2928	Unicorn-54770.exe
2708	Unicorn-21997.exe
2776	Unicorn-36296.exe
2148	Unicorn-47157.exe
2692	Unicorn-22049.exe
2252	Unicorn-63444.exe
2108	Unicorn-55297.exe
3040	Unicorn-44726.exe
2300	Unicorn-2012.exe
3036	Unicorn-12218.exe
3028	Unicorn-47684.exe
2328	Unicorn-12894.exe
1744	Unicorn-9365.exe
2096	Unicorn-14347.exe
2272	Unicorn-43682.exe
2684	Unicorn-35322.exe
1968	Unicorn-6655.exe
1408	Unicorn-63932.exe
2604	Unicorn-33105.exe
1848	Unicorn-33206.exe
1244	Unicorn-65116.exe
1816	Unicorn-51488.exe
288	Unicorn-4425.exe
2556	Unicorn-10190.exe
1736	Unicorn-54757.exe
1560	Unicorn-36112.exe
2268	Unicorn-40750.exe
2324	Unicorn-52448.exe
1472	Unicorn-62654.exe
1620	Unicorn-56916.exe
1184	Unicorn-54778.exe
1608	Unicorn-36396.exe
2856	Unicorn-4508.exe
2932	Unicorn-4243.exe
2312	Unicorn-7777.exe
1048	Unicorn-35811.exe
2848	Unicorn-24742.exe
3032	Unicorn-13060.exe
2732	Unicorn-33673.exe
2904	Unicorn-13152.exe
1352	Unicorn-35619.exe
2416	Unicorn-9644.exe
2508	Unicorn-51140.exe
2640	Unicorn-5468.exe
1100	Unicorn-3885.exe
1984	Unicorn-54861.exe
1260	Unicorn-13828.exe
2240	Unicorn-13563.exe
2968	Unicorn-36003.exe
2016	Unicorn-13828.exe
1612	Unicorn-13563.exe
2188	Unicorn-6215.exe
436	Unicorn-29395.exe
2024	Unicorn-13828.exe
2228	Unicorn-46593.exe
1124	Unicorn-46315.exe
1636	Unicorn-49023.exe
972	Unicorn-26465.exe
2404	Unicorn-2152.exe
2164	Unicorn-953.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 2892	392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe	29
PID 392 wrote to memory of 2892	392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe	29
PID 392 wrote to memory of 2892	392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe	29
PID 392 wrote to memory of 2892	392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe	29
PID 2892 wrote to memory of 2840	2892	Unicorn-32539.exe	31
PID 2892 wrote to memory of 2840	2892	Unicorn-32539.exe	31
PID 2892 wrote to memory of 2840	2892	Unicorn-32539.exe	31
PID 2892 wrote to memory of 2840	2892	Unicorn-32539.exe	31
PID 392 wrote to memory of 2820	392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe	30
PID 392 wrote to memory of 2820	392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe	30
PID 392 wrote to memory of 2820	392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe	30
PID 392 wrote to memory of 2820	392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe	30
PID 2892 wrote to memory of 2148	2892	Unicorn-32539.exe	33
PID 2892 wrote to memory of 2148	2892	Unicorn-32539.exe	33
PID 2892 wrote to memory of 2148	2892	Unicorn-32539.exe	33
PID 2892 wrote to memory of 2148	2892	Unicorn-32539.exe	33
PID 2840 wrote to memory of 2928	2840	Unicorn-58195.exe	32
PID 2840 wrote to memory of 2928	2840	Unicorn-58195.exe	32
PID 2840 wrote to memory of 2928	2840	Unicorn-58195.exe	32
PID 2840 wrote to memory of 2928	2840	Unicorn-58195.exe	32
PID 392 wrote to memory of 2708	392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe	35
PID 392 wrote to memory of 2708	392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe	35
PID 392 wrote to memory of 2708	392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe	35
PID 392 wrote to memory of 2708	392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe	35
PID 2820 wrote to memory of 2776	2820	Unicorn-28023.exe	34
PID 2820 wrote to memory of 2776	2820	Unicorn-28023.exe	34
PID 2820 wrote to memory of 2776	2820	Unicorn-28023.exe	34
PID 2820 wrote to memory of 2776	2820	Unicorn-28023.exe	34
PID 2928 wrote to memory of 2692	2928	Unicorn-54770.exe	36
PID 2928 wrote to memory of 2692	2928	Unicorn-54770.exe	36
PID 2928 wrote to memory of 2692	2928	Unicorn-54770.exe	36
PID 2928 wrote to memory of 2692	2928	Unicorn-54770.exe	36
PID 2840 wrote to memory of 2252	2840	Unicorn-58195.exe	37
PID 2840 wrote to memory of 2252	2840	Unicorn-58195.exe	37
PID 2840 wrote to memory of 2252	2840	Unicorn-58195.exe	37
PID 2840 wrote to memory of 2252	2840	Unicorn-58195.exe	37
PID 2776 wrote to memory of 2108	2776	Unicorn-36296.exe	38
PID 2776 wrote to memory of 2108	2776	Unicorn-36296.exe	38
PID 2776 wrote to memory of 2108	2776	Unicorn-36296.exe	38
PID 2776 wrote to memory of 2108	2776	Unicorn-36296.exe	38
PID 392 wrote to memory of 3040	392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe	39
PID 392 wrote to memory of 3040	392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe	39
PID 392 wrote to memory of 3040	392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe	39
PID 392 wrote to memory of 3040	392	52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe	39
PID 2892 wrote to memory of 3036	2892	Unicorn-32539.exe	40
PID 2892 wrote to memory of 3036	2892	Unicorn-32539.exe	40
PID 2892 wrote to memory of 3036	2892	Unicorn-32539.exe	40
PID 2892 wrote to memory of 3036	2892	Unicorn-32539.exe	40
PID 2708 wrote to memory of 2300	2708	Unicorn-21997.exe	41
PID 2708 wrote to memory of 2300	2708	Unicorn-21997.exe	41
PID 2708 wrote to memory of 2300	2708	Unicorn-21997.exe	41
PID 2708 wrote to memory of 2300	2708	Unicorn-21997.exe	41
PID 2820 wrote to memory of 3028	2820	Unicorn-28023.exe	42
PID 2820 wrote to memory of 3028	2820	Unicorn-28023.exe	42
PID 2820 wrote to memory of 3028	2820	Unicorn-28023.exe	42
PID 2820 wrote to memory of 3028	2820	Unicorn-28023.exe	42
PID 2692 wrote to memory of 2328	2692	Unicorn-22049.exe	43
PID 2692 wrote to memory of 2328	2692	Unicorn-22049.exe	43
PID 2692 wrote to memory of 2328	2692	Unicorn-22049.exe	43
PID 2692 wrote to memory of 2328	2692	Unicorn-22049.exe	43
PID 2928 wrote to memory of 1744	2928	Unicorn-54770.exe	44
PID 2928 wrote to memory of 1744	2928	Unicorn-54770.exe	44
PID 2928 wrote to memory of 1744	2928	Unicorn-54770.exe	44
PID 2928 wrote to memory of 1744	2928	Unicorn-54770.exe	44

C:\Users\Admin\AppData\Local\Temp\52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe
"C:\Users\Admin\AppData\Local\Temp\52ac27f1e532ad660fe954284eb8674c876d933cc932131f286801bcb201b9a8.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32539.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32539.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54770.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22049.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12894.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36112.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61597.exe
        8⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45213.exe
        8⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        8⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
        8⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60402.exe
        7⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        7⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37138.exe
        7⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42139.exe
        7⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63447.exe
        7⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40750.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13828.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28645.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23356.exe
        8⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27823.exe
        8⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50533.exe
        7⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54939.exe
        7⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38293.exe
        7⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
        7⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        7⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38571.exe
        7⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31551.exe
        7⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49796.exe
        6⤵
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63864.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36695.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52448.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51291.exe
        7⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27310.exe
        7⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12151.exe
        7⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17872.exe
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2266.exe
        7⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60590.exe
        6⤵
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41046.exe
        6⤵
        
        PID:884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18016.exe
        6⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18282.exe
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
        6⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62654.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13828.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-995.exe
        7⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52395.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64669.exe
        7⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13788.exe
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
        7⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41404.exe
        6⤵
        
        PID:1108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
        6⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23421.exe
        6⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13563.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13548.exe
        6⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46553.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22074.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47159.exe
        6⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
        6⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57602.exe
        5⤵
        
        PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40952.exe
        5⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54374.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33400.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8356.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2888.exe
        5⤵
        
        PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6655.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54778.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11135.exe
        6⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58037.exe
        6⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34135.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62316.exe
        6⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32686.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13289.exe
        6⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46761.exe
        6⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41046.exe
        5⤵
        
        PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11986.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47074.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24635.exe
        5⤵
        
        PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4243.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2152.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7944.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7866.exe
        6⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36002.exe
        5⤵
        
        PID:900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40342.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38701.exe
        6⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18016.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3892.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42658.exe
        5⤵
        
        PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46315.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        5⤵
        
        PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42738.exe
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52355.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3407.exe
      4⤵
      PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49440.exe
      4⤵
      PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19928.exe
      4⤵
      PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48220.exe
      4⤵
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11056.exe
      4⤵
      PID:2520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43682.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56916.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46667.exe
        6⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        6⤵
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        6⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59028.exe
        5⤵
        
        PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-699.exe
        5⤵
        
        PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53674.exe
        5⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25073.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19440.exe
        5⤵
        
        PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exe
        5⤵
        
        PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48115.exe
        5⤵
        
        PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39480.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
        5⤵
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47382.exe
        5⤵
        
        PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51986.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59050.exe
      4⤵
      PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51145.exe
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42139.exe
      4⤵
      PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe
      4⤵
      PID:5000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4425.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13828.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        6⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58037.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39082.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64334.exe
        6⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
        5⤵
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41046.exe
        5⤵
        
        PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18016.exe
        5⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62790.exe
        5⤵
        
        PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        5⤵
        
        PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6215.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23518.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53616.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38697.exe
        5⤵
        
        PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-184.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe
      4⤵
      PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23030.exe
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27102.exe
      4⤵
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe
      4⤵
      PID:4456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10190.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26465.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27524.exe
        6⤵
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56745.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44409.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27576.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9007.exe
        5⤵
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44603.exe
        5⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2528.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64018.exe
        5⤵
        
        PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-953.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7658.exe
        5⤵
        
        PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4943.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19547.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25592.exe
        5⤵
        
        PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11694.exe
      4⤵
      PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
      4⤵
      PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2143.exe
      4⤵
      PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25073.exe
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50167.exe
      4⤵
      PID:5092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24742.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3709.exe
      4⤵
      PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
      4⤵
      PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11384.exe
      4⤵
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30008.exe
      4⤵
      PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46166.exe
      4⤵
      PID:4332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58018.exe
    3⤵
    PID:2440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
    3⤵
    PID:3924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62312.exe
    3⤵
    PID:5080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28023.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28023.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55297.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14347.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4508.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49023.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-995.exe
        8⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9526.exe
        8⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44603.exe
        8⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51244.exe
        8⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42658.exe
        8⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        7⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
        7⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39082.exe
        7⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2881.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3968.exe
        6⤵
        Executes dropped EXE
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-995.exe
        7⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe
        7⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44603.exe
        7⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16433.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
        7⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60402.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37138.exe
        6⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29887.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38942.exe
        6⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7777.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe
        6⤵
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27310.exe
        6⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38219.exe
        6⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35770.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        6⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35623.exe
        5⤵
        
        PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42827.exe
        5⤵
        
        PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24689.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60473.exe
        5⤵
        
        PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35322.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33673.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39423.exe
        6⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27310.exe
        6⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34135.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61688.exe
        6⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9827.exe
        5⤵
        
        PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21393.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        5⤵
        
        PID:340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
        5⤵
        
        PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12780.exe
        5⤵
        
        PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2806.exe
        5⤵
        
        PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2994.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60351.exe
        5⤵
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23415.exe
        5⤵
        
        PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49848.exe
      4⤵
      PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18593.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13939.exe
      4⤵
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25460.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6856.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47684.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33206.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49210.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36028.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49074.exe
        6⤵
        
        PID:1116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46958.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57696.exe
        6⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46667.exe
        5⤵
        
        PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55930.exe
        5⤵
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53674.exe
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        5⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60473.exe
        5⤵
        
        PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51140.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39916.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16236.exe
        5⤵
        
        PID:580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26925.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5349.exe
        5⤵
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59943.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12100.exe
      4⤵
      PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9351.exe
      4⤵
      PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
      4⤵
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64557.exe
      4⤵
      PID:4812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54861.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18920.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50964.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62588.exe
        6⤵
        
        PID:388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56474.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50274.exe
        6⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49637.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45489.exe
        5⤵
        
        PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47702.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        5⤵
        
        PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42032.exe
      4⤵
      PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36002.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57295.exe
      4⤵
      PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
      4⤵
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59744.exe
      4⤵
      PID:4100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13563.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13563.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45474.exe
      4⤵
      PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19481.exe
      4⤵
      PID:4476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6320.exe
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32374.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41459.exe
    3⤵
    PID:3128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53555.exe
    3⤵
    PID:3572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4536
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21997.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21997.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2012.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51488.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5468.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        6⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5042.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50793.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53657.exe
        5⤵
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        5⤵
        
        PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28067.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2772.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21127.exe
        5⤵
        
        PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41862.exe
        5⤵
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27310.exe
        5⤵
        
        PID:568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12151.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8473.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29216.exe
        5⤵
        
        PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
      4⤵
      PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22407.exe
      4⤵
      PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9351.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52894.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21127.exe
      4⤵
      PID:4616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13060.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21601.exe
        5⤵
        
        PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4185.exe
      4⤵
      PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39018.exe
      4⤵
      PID:640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53674.exe
      4⤵
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29747.exe
      4⤵
      PID:4668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26839.exe
      4⤵
      PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16209.exe
      4⤵
      PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59210.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18801.exe
      4⤵
      PID:4528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57488.exe
    3⤵
    PID:2116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23602.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19992.exe
    3⤵
    PID:4724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63932.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43808.exe
      4⤵
      PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34906.exe
      4⤵
      PID:2488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10808.exe
      4⤵
      PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10882.exe
      4⤵
      PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
      4⤵
      PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45816.exe
    3⤵
    PID:2812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41046.exe
    3⤵
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18016.exe
    3⤵
    PID:3628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43171.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43171.exe
    3⤵
    PID:2544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2375.exe
    3⤵
    PID:5024
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65116.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65116.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36003.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11135.exe
      4⤵
      PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-96.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-96.exe
      4⤵
      PID:584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
      4⤵
      PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe
    3⤵
    PID:2264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5961.exe
    3⤵
    PID:1004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32753.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38823.exe
    3⤵
    PID:3372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52704.exe
    3⤵
    PID:4592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27280.exe
    3⤵
    PID:524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
    3⤵
    PID:2536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51710.exe
    3⤵
    PID:3240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe
    3⤵
    PID:3324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64250.exe
    3⤵
    PID:3516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41160.exe
    3⤵
    PID:4912
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20825.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20825.exe
  2⤵
  PID:2280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6171.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6171.exe
  2⤵
  PID:1488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
  2⤵
  PID:3804
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13443.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13443.exe
  2⤵
  PID:3788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44882.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44882.exe
  2⤵
  PID:4748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11694.exe

Filesize
468KB

MD5
99f32b32a4ee2ab6da881e50c1771e53

SHA1
591f3c0db5ea838402222f1a3dfdfa4e55ae3779

SHA256
fca282d1769413b5a7b123f2593cfc341a664dd8aa190765acb56b3cb9986fc8

SHA512
565178b6925f4b7768ae3e0c489c3620ea0b7fe176d26c2d4395e40685ac4354298e06d51931097df6476b74b0b208b4ca6c39bea97b1a1c4ca22fff4332c56c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12894.exe

Filesize
468KB

MD5
b2cb8836612cfd8675f593955492fbd9

SHA1
1c018c0a3c12c3b25e005f2b0a388195ceb190c8

SHA256
e53da93498fc5b83816797d12c02227b414cbdeedfceeafba56b95f3f1f96126

SHA512
01450139fb78d3fce56148e3533f65e04cc1b4d69ef1a67716bce7a1be072a7e67e9188966e79883dfd5104067ef6306cff01b4c245e5fc5c4b48fabf41911d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2012.exe

Filesize
468KB

MD5
b7964d59f7257a2872de7b72422f177a

SHA1
5ad517768ac1e3ea4360bd4e9e5cb04101b36403

SHA256
368892783e976e07790709194c54db699c32a419a5fe104f7442f3ab4028a98d

SHA512
3e65083e438af9b818df99294ba669b9ca489ad49369219d21181a9e02e3748374661d43c0dfe483deda869d277236e643c2c8bda81903fbefc0ed1fc5976a03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21997.exe

Filesize
468KB

MD5
0120a6ac6a447782ad3e919bfd0914d4

SHA1
e837221b64ce62edcd551afd9e4fab1a42ba05fb

SHA256
e71725501adb974bdd74a42d96a37ce3ffd13b82e50f2f056cdd1cdeb86b25a0

SHA512
0c19440bbe57d6c47bea5b64a3f862b80394df42ddcab0ed0a805cb196bbc039200dd83a99c57526505e156578a2397b701356834dabdb49397f82553bd17019

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22049.exe

Filesize
468KB

MD5
e92f89167bdfaa6e4bd8ae4182c0752b

SHA1
f43097e6abd299fcdcfddfb4c11874449f20c84f

SHA256
866249f85e1dbe1e5096c3db76a9d89073d9b3e0b03bf727678e3730643ef78d

SHA512
8bb91a575d570044963616317b6c3f9cf7f5261f4c940f87b8f27ca4bbeaa706c2973f7d06e54d93a66c3d1a5eab92e2c33fef38a734e090cb82247ef609912f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40952.exe

Filesize
468KB

MD5
5c42a4d75f001c823d132e81cc519298

SHA1
20f157e3e72b0ef0f6ae0f63e373dd0a72086e2d

SHA256
0b147af6f90beecd5ced381ae734d2738cf0fefe139b20d9e138a9b296edae91

SHA512
de87306c58441601a8534d9605bbcfa570ed8f06d5feaa8361c074fc60756996452637b69d72f9c959459b69ac919b5f282b0e4eb7fc9e5f8c51f7a52f1e99dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe

Filesize
468KB

MD5
59c458f03ee733680ac987af45c84c69

SHA1
bcb4978dbbdd617b9258439c6e4c23d9d65299f2

SHA256
6a9bc657ee30b406f488b1ca4409110583fb817860c6aacca01c78cacc841c43

SHA512
3002566cdbaf5199ab3454cc4f003cca358e1fd97e6f5164b6cd79f1e1f7aec9938937eeac7ec54cf80c13055be23dd19e3c98ce68b38ab0acb63bdb8093bb28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50533.exe

Filesize
468KB

MD5
ee3ba065f4bd03cfbb95eb48fa71752f

SHA1
f8db1cd6a65c2d0ecb0b2c4138e9a1908ebd19c5

SHA256
8105ac4ae94c90b509717ec9ca46146b5ee800be7694dad439579b8dd705ec4f

SHA512
db0728d8b53a984ba1bec8632cc482b98f5dd263ae57996d9c9e6c438d7c55583fabf52efba988aff169d805d08ec0c159c5767b0e714fb6d37204cb3f4c2147

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe

Filesize
468KB

MD5
a0c8ecbcdbb7de81dfb757395ebf1519

SHA1
ea144ccff77d6190e27a1d377f9a51c28fa20abf

SHA256
9a4d59c735666f7ff9479125aefe6b412de04f34e55450c443a8824c21b677aa

SHA512
544489a643a6ec9ab64c912bf8622644ead2dec487b44de69366ec43e3118f6cd4f02b5b1c8cb155e1dceaa09d906cf1eed7ec38350df0a6dfc83403f62ea11b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe

Filesize
468KB

MD5
743680fda5ffd1e7e3e251bff32abf30

SHA1
0ce3600af7a7ed5bc3dcf8d4e7e5e3165a2969d9

SHA256
a2818328d3c98123e6734db3bff1c0bc565268a946301c3b866416b664d7b92e

SHA512
38418567efa2d5a2889b16427c8a40e70de7edd84b1e9f75f3a5a302e255b007527b285b5e895d39230fe62e500233020c017ec87dce1aa05647ee1af2f3b3e8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe

Filesize
468KB

MD5
1a0495fa571d1a2d2f3ece3e8b26ac9d

SHA1
54246c06eefb2dd9633a9674ebc9974d1cf38a2a

SHA256
841791f71782ce7a5a72b49056430458be7219c57e240031fc275b9eaffb95b3

SHA512
dc6b620b7257b8ec146dcb66127084c5440b60a99d004643d0d56ffe7eb880f710c799c31aac4dba952599288ff359736c46a83f5214b5836fb5e508f19f72fe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14347.exe

Filesize
468KB

MD5
019def82aeb0929f3b1d3db887e93463

SHA1
c560ed13d2a84fd6f50807e84b7d59b7ae1137b9

SHA256
2408e4feaddecca51f6388f75558439a1a19c98e21b02ea933bd2e15793f5ae0

SHA512
5123b8d5ef74e4eed8a4d4350c68f33d90ce326d481bc23b5c143bce2dd8f600bb39d15b6f31a5caf7491f90ca872a7b428da275e6b1c1f19ffdba60436f2210

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28023.exe

Filesize
468KB

MD5
cc57f53fb5b02fe984070ec3d0e09886

SHA1
d0ee2891a99b3670ba8d68706a59b64b97c7eba4

SHA256
c5cb0d039f6522c153aa2e1455f3a114040c66d26112dac03092e1bedfba5dbd

SHA512
f8ae29cbf05e51bbf0f799974d61072f0489b27cfe87e58434ea615e9b7884917e502154632a3da7931c88bfeff0398b81a0ab3dd5c292c7dd52ff813f3896bf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32539.exe

Filesize
468KB

MD5
46a15f130cf5121163f409a8862274f5

SHA1
a6293c4e59c2de4295805c3a2e4a3b5e41fa1d0c

SHA256
811850f5fc5fc3bb57e3f23b0ea804970c2ee4bbda3b7a13ea57c57ca9872256

SHA512
404bffee9b87aa903865e8a73f4a3a95bb7a59848c0ae12094d40482cc629caf45656abb5adacb8999dc95c7810c82515c656a6d5de48ab4bceb08aa08a1e97b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe

Filesize
468KB

MD5
68662f0fb47e6ee5085fa8a6b42049da

SHA1
b6b3617b3da94add8dad35d684009b83b88a03ce

SHA256
cdc6cf8e17390c9114c0ce6f7fff1f907f62979c29e266de3b47a68b254a75a3

SHA512
23dfdd8acd8ddf50e78bfe50911624375ad20a9ecbd28579799a7d5f67b52b90ca44d0153ad1eea5e1f9049d2e0e570b909f2d32829ac0403aa379f15f4e9f82

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43682.exe

Filesize
468KB

MD5
b06709fe46c49b193b83b526eba658de

SHA1
94e1ebca1d505f6cc862ed23bcad51ca372138cc

SHA256
34017e37d00a139daaf98c749ecb12d2643f3b5f4f734a690f0b69319f2c9458

SHA512
02b4d2eda4eb3126239d0e67b12c00f1dca883369099c8f6ff22e606e5f8e8e4fb97346705af2031f69e9fab01ea38b4863800a4ebd794d08640af0949369d40

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe

Filesize
468KB

MD5
6bd523f3a0995a22ae0e6ba2ac54f3a9

SHA1
6e91f57e00d0347e98e599a71dad5cce843804ca

SHA256
99834a5231689848ab6044d94a0bc7e9eaee1c2c5d46c5aa2c5145577264925b

SHA512
914801734c46c909bd22f26c617012fc2ee05114f132e8b46a34058c8ffcee1b342c10cf2b38f1f03e8a22e742840bf166fed6da8ff1fab7feb745545010e697

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47684.exe

Filesize
468KB

MD5
9bedb59f69217bc28e24be2701787747

SHA1
f90bd655c63d30e51f125401a1624ceebd9f4eda

SHA256
1ae8ed077aa96e3a2c517354f25a1a4ef216eba2e6ed252a7583961ea6520ce8

SHA512
4f6ef74d6ea253704862dfcc77763e53f38dfaa41dd3a990ba1676a059fb8502c56d0f9b364226753bd43909e346589b9689cfdfbde76e404d55b7875506437e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54770.exe

Filesize
468KB

MD5
8b25acf76036bae3bc3199848913ea83

SHA1
65b5c3bd9f10a848b070deb04e443d9e69e7e71b

SHA256
42ea290bd1d9ae5ce4a47594704127bf909677fdd60373662867a79b16e0d6ad

SHA512
22075838a1c6dc743e710d0e11513549d77d8aa6cdfb80a299a3e17bcf6088f24116159bd30404b0359b6e0217a79e6bb57f0107a48b9645d82a13cc27d695c1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55297.exe

Filesize
468KB

MD5
6f2bd9bf8684588bc35209d7fdd00db0

SHA1
326d348a986ebc46e88ede1b592d5a17395f7cb6

SHA256
c1c39afbc7e430bc547a59d87a72cf55c55b648ea9deee9b1c44144bfc015221

SHA512
69778e83950a5e2a61c37a6e186b4bdca5c4f15fec34c60c1103344b237739e226eae89c5270b8a527b772a57f40df63b7fa419c1474cd1341d9992b2d86ff59

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe

Filesize
468KB

MD5
6f1f59ae709033ae93d53ec44e9f7223

SHA1
dd5fa56ba0320732894f21e49004ae3631a8eb3e

SHA256
a3aa8f17d7e6fa846a6016130080e481d83fd93e1d8aa38965d70a98976b78e2

SHA512
24725ab1796a87b69d288dc83f08387b1669c1cc2768c1f70e0b95570bfe4758d932fdcc434f1d29a0557cc2a721a2333659260c945eb19b541733ac38e1bfb1

Download Submit