f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293

Analysis

max time kernel
149s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe
Size

468KB
MD5

d20bb809c5b82e56d70a52126ca725cb
SHA1

f4bf0efc8282337bbe12a3392730560310127ab0
SHA256

f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293
SHA512

c464e3b6126e2a0c8e27d285228825dac01d83510f221867ab33c77fb5501920bb696d587dc06cd41fd7e2bfa17104b898bd6fddc146c1325ce2bc68c9a4e24b
SSDEEP

3072:3FfnogKxj2TU2bYYBz3yqf8/EC3yyIplPmfC5VuA16s+03LjtYlz:3FfotYU2DBDyqfg0/P16LCLjt

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2828	Unicorn-10814.exe
2824	Unicorn-61162.exe
2900	Unicorn-24960.exe
2960	Unicorn-12052.exe
2744	Unicorn-63500.exe
612	Unicorn-10386.exe
1740	Unicorn-32865.exe
2392	Unicorn-24518.exe
2572	Unicorn-5228.exe
2700	Unicorn-1248.exe
2980	Unicorn-63640.exe
1608	Unicorn-49681.exe
1892	Unicorn-17127.exe
1712	Unicorn-17393.exe
736	Unicorn-52103.exe
2252	Unicorn-14434.exe
1988	Unicorn-41377.exe
1644	Unicorn-19635.exe
2168	Unicorn-36032.exe
1348	Unicorn-36163.exe
2460	Unicorn-41491.exe
2160	Unicorn-49266.exe
1952	Unicorn-48197.exe
732	Unicorn-2954.exe
2128	Unicorn-724.exe
3004	Unicorn-55140.exe
868	Unicorn-55140.exe
2584	Unicorn-25997.exe
1584	Unicorn-50309.exe
2716	Unicorn-50044.exe
2880	Unicorn-7362.exe
2884	Unicorn-54668.exe
2660	Unicorn-1938.exe
1264	Unicorn-54860.exe
2628	Unicorn-47770.exe
2612	Unicorn-5275.exe
2496	Unicorn-9722.exe
2080	Unicorn-52084.exe
2092	Unicorn-26812.exe
2940	Unicorn-11444.exe
2984	Unicorn-22213.exe
1324	Unicorn-17767.exe
1060	Unicorn-35758.exe
656	Unicorn-3350.exe
2236	Unicorn-10428.exe
2368	Unicorn-30678.exe
2232	Unicorn-35019.exe
1096	Unicorn-22785.exe
2224	Unicorn-23854.exe
1936	Unicorn-14206.exe
1784	Unicorn-27941.exe
904	Unicorn-34072.exe
1956	Unicorn-16774.exe
1580	Unicorn-9375.exe
2440	Unicorn-57424.exe
2788	Unicorn-33112.exe
1120	Unicorn-13246.exe
2576	Unicorn-38793.exe
2020	Unicorn-62722.exe
832	Unicorn-33387.exe
2132	Unicorn-54746.exe
1668	Unicorn-11186.exe
2836	Unicorn-11570.exe
2912	Unicorn-26519.exe

Loads dropped DLL 64 IoCs

pid	Process
1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe
1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe
2828	Unicorn-10814.exe
2828	Unicorn-10814.exe
1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe
1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe
2824	Unicorn-61162.exe
2824	Unicorn-61162.exe
2900	Unicorn-24960.exe
2900	Unicorn-24960.exe
2828	Unicorn-10814.exe
2828	Unicorn-10814.exe
1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe
1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe
2960	Unicorn-12052.exe
2960	Unicorn-12052.exe
2824	Unicorn-61162.exe
2824	Unicorn-61162.exe
2744	Unicorn-63500.exe
2744	Unicorn-63500.exe
2900	Unicorn-24960.exe
2900	Unicorn-24960.exe
1740	Unicorn-32865.exe
1740	Unicorn-32865.exe
1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe
1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe
612	Unicorn-10386.exe
612	Unicorn-10386.exe
2828	Unicorn-10814.exe
2828	Unicorn-10814.exe
2392	Unicorn-24518.exe
2392	Unicorn-24518.exe
2960	Unicorn-12052.exe
2960	Unicorn-12052.exe
2700	Unicorn-1248.exe
2700	Unicorn-1248.exe
2744	Unicorn-63500.exe
2744	Unicorn-63500.exe
2572	Unicorn-5228.exe
2572	Unicorn-5228.exe
2824	Unicorn-61162.exe
2824	Unicorn-61162.exe
1608	Unicorn-49681.exe
1608	Unicorn-49681.exe
2980	Unicorn-63640.exe
2980	Unicorn-63640.exe
2900	Unicorn-24960.exe
2900	Unicorn-24960.exe
1712	Unicorn-17393.exe
1712	Unicorn-17393.exe
612	Unicorn-10386.exe
612	Unicorn-10386.exe
1740	Unicorn-32865.exe
1740	Unicorn-32865.exe
736	Unicorn-52103.exe
736	Unicorn-52103.exe
1892	Unicorn-17127.exe
2828	Unicorn-10814.exe
1892	Unicorn-17127.exe
2828	Unicorn-10814.exe
1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe
1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe
2252	Unicorn-14434.exe
2252	Unicorn-14434.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41332.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6452.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe
2828	Unicorn-10814.exe
2824	Unicorn-61162.exe
2900	Unicorn-24960.exe
2960	Unicorn-12052.exe
2744	Unicorn-63500.exe
612	Unicorn-10386.exe
1740	Unicorn-32865.exe
2392	Unicorn-24518.exe
2700	Unicorn-1248.exe
2572	Unicorn-5228.exe
1608	Unicorn-49681.exe
2980	Unicorn-63640.exe
1712	Unicorn-17393.exe
736	Unicorn-52103.exe
1892	Unicorn-17127.exe
2252	Unicorn-14434.exe
1988	Unicorn-41377.exe
1644	Unicorn-19635.exe
2168	Unicorn-36032.exe
1348	Unicorn-36163.exe
2460	Unicorn-41491.exe
2160	Unicorn-49266.exe
1952	Unicorn-48197.exe
3004	Unicorn-55140.exe
1584	Unicorn-50309.exe
2716	Unicorn-50044.exe
2884	Unicorn-54668.exe
2880	Unicorn-7362.exe
732	Unicorn-2954.exe
868	Unicorn-55140.exe
1264	Unicorn-54860.exe
2496	Unicorn-9722.exe
1324	Unicorn-17767.exe
2128	Unicorn-724.exe
2984	Unicorn-22213.exe
2660	Unicorn-1938.exe
656	Unicorn-3350.exe
1060	Unicorn-35758.exe
2092	Unicorn-26812.exe
2628	Unicorn-47770.exe
2612	Unicorn-5275.exe
2080	Unicorn-52084.exe
2940	Unicorn-11444.exe
2232	Unicorn-35019.exe
2368	Unicorn-30678.exe
2236	Unicorn-10428.exe
1936	Unicorn-14206.exe
2440	Unicorn-57424.exe
2224	Unicorn-23854.exe
1120	Unicorn-13246.exe
1096	Unicorn-22785.exe
2576	Unicorn-38793.exe
1956	Unicorn-16774.exe
832	Unicorn-33387.exe
1784	Unicorn-27941.exe
904	Unicorn-34072.exe
2020	Unicorn-62722.exe
1580	Unicorn-9375.exe
2788	Unicorn-33112.exe
2836	Unicorn-11570.exe
2132	Unicorn-54746.exe
1632	Unicorn-63293.exe
2040	Unicorn-19682.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2828	1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe	29
PID 1944 wrote to memory of 2828	1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe	29
PID 1944 wrote to memory of 2828	1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe	29
PID 1944 wrote to memory of 2828	1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe	29
PID 2828 wrote to memory of 2824	2828	Unicorn-10814.exe	30
PID 2828 wrote to memory of 2824	2828	Unicorn-10814.exe	30
PID 2828 wrote to memory of 2824	2828	Unicorn-10814.exe	30
PID 2828 wrote to memory of 2824	2828	Unicorn-10814.exe	30
PID 1944 wrote to memory of 2900	1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe	31
PID 1944 wrote to memory of 2900	1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe	31
PID 1944 wrote to memory of 2900	1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe	31
PID 1944 wrote to memory of 2900	1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe	31
PID 2824 wrote to memory of 2960	2824	Unicorn-61162.exe	32
PID 2824 wrote to memory of 2960	2824	Unicorn-61162.exe	32
PID 2824 wrote to memory of 2960	2824	Unicorn-61162.exe	32
PID 2824 wrote to memory of 2960	2824	Unicorn-61162.exe	32
PID 2900 wrote to memory of 2744	2900	Unicorn-24960.exe	33
PID 2900 wrote to memory of 2744	2900	Unicorn-24960.exe	33
PID 2900 wrote to memory of 2744	2900	Unicorn-24960.exe	33
PID 2900 wrote to memory of 2744	2900	Unicorn-24960.exe	33
PID 2828 wrote to memory of 612	2828	Unicorn-10814.exe	34
PID 2828 wrote to memory of 612	2828	Unicorn-10814.exe	34
PID 2828 wrote to memory of 612	2828	Unicorn-10814.exe	34
PID 2828 wrote to memory of 612	2828	Unicorn-10814.exe	34
PID 1944 wrote to memory of 1740	1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe	35
PID 1944 wrote to memory of 1740	1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe	35
PID 1944 wrote to memory of 1740	1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe	35
PID 1944 wrote to memory of 1740	1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe	35
PID 2960 wrote to memory of 2392	2960	Unicorn-12052.exe	36
PID 2960 wrote to memory of 2392	2960	Unicorn-12052.exe	36
PID 2960 wrote to memory of 2392	2960	Unicorn-12052.exe	36
PID 2960 wrote to memory of 2392	2960	Unicorn-12052.exe	36
PID 2824 wrote to memory of 2572	2824	Unicorn-61162.exe	37
PID 2824 wrote to memory of 2572	2824	Unicorn-61162.exe	37
PID 2824 wrote to memory of 2572	2824	Unicorn-61162.exe	37
PID 2824 wrote to memory of 2572	2824	Unicorn-61162.exe	37
PID 2744 wrote to memory of 2700	2744	Unicorn-63500.exe	38
PID 2744 wrote to memory of 2700	2744	Unicorn-63500.exe	38
PID 2744 wrote to memory of 2700	2744	Unicorn-63500.exe	38
PID 2744 wrote to memory of 2700	2744	Unicorn-63500.exe	38
PID 2900 wrote to memory of 2980	2900	Unicorn-24960.exe	39
PID 2900 wrote to memory of 2980	2900	Unicorn-24960.exe	39
PID 2900 wrote to memory of 2980	2900	Unicorn-24960.exe	39
PID 2900 wrote to memory of 2980	2900	Unicorn-24960.exe	39
PID 1740 wrote to memory of 1608	1740	Unicorn-32865.exe	40
PID 1740 wrote to memory of 1608	1740	Unicorn-32865.exe	40
PID 1740 wrote to memory of 1608	1740	Unicorn-32865.exe	40
PID 1740 wrote to memory of 1608	1740	Unicorn-32865.exe	40
PID 1944 wrote to memory of 1892	1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe	41
PID 1944 wrote to memory of 1892	1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe	41
PID 1944 wrote to memory of 1892	1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe	41
PID 1944 wrote to memory of 1892	1944	f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe	41
PID 612 wrote to memory of 1712	612	Unicorn-10386.exe	42
PID 612 wrote to memory of 1712	612	Unicorn-10386.exe	42
PID 612 wrote to memory of 1712	612	Unicorn-10386.exe	42
PID 612 wrote to memory of 1712	612	Unicorn-10386.exe	42
PID 2828 wrote to memory of 736	2828	Unicorn-10814.exe	43
PID 2828 wrote to memory of 736	2828	Unicorn-10814.exe	43
PID 2828 wrote to memory of 736	2828	Unicorn-10814.exe	43
PID 2828 wrote to memory of 736	2828	Unicorn-10814.exe	43
PID 2392 wrote to memory of 2252	2392	Unicorn-24518.exe	44
PID 2392 wrote to memory of 2252	2392	Unicorn-24518.exe	44
PID 2392 wrote to memory of 2252	2392	Unicorn-24518.exe	44
PID 2392 wrote to memory of 2252	2392	Unicorn-24518.exe	44

C:\Users\Admin\AppData\Local\Temp\f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe
"C:\Users\Admin\AppData\Local\Temp\f83b82a94caecb3314a45952c6738877b40897ed436952a6ca770e3094661293.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10814.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10814.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12052.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24518.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23854.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10738.exe
        9⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4869.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
        9⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20437.exe
        9⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
        9⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58955.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57282.exe
        9⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41542.exe
        9⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        9⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        9⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        9⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42792.exe
        8⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44890.exe
        8⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54414.exe
        8⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        8⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        7⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29348.exe
        7⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        7⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53391.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59128.exe
        7⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25595.exe
        7⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1938.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        7⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-105.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7220.exe
        8⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21540.exe
        8⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13248.exe
        8⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        8⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
        7⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        7⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        7⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62781.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2915.exe
        7⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        6⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34755.exe
        6⤵
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55846.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27093.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
        6⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41377.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11570.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        7⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2185.exe
        7⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43629.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        7⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        7⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43427.exe
        6⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9683.exe
        6⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15450.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28975.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        6⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47770.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19463.exe
        5⤵
        
        PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30187.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        5⤵
        
        PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36163.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26812.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        8⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6452.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46429.exe
        8⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46113.exe
        8⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        8⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        7⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62081.exe
        7⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        7⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53769.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        7⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        6⤵
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24195.exe
        6⤵
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
        6⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46643.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
        6⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22213.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34207.exe
        6⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59607.exe
        7⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57210.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28608.exe
        7⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        6⤵
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26964.exe
        6⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45298.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44678.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2228.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10966.exe
        5⤵
        
        PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18231.exe
        5⤵
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30187.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        5⤵
        
        PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41491.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17767.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9033.exe
        7⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52731.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38802.exe
        8⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
        8⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exe
        8⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
        8⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        8⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65346.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18028.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45298.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50882.exe
        7⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54811.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        6⤵
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29465.exe
        6⤵
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        6⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43629.exe
        6⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        6⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62722.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41332.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9585.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20409.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53769.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37745.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        6⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26841.exe
        5⤵
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19099.exe
        6⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61470.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exe
        6⤵
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
        6⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        6⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
        5⤵
        
        PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24164.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20097.exe
        5⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42846.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        5⤵
        
        PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35758.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63293.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61485.exe
        5⤵
        
        PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9585.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43629.exe
        5⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        5⤵
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19682.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exe
      4⤵
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61397.exe
        5⤵
        
        PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37666.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5589.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        5⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        5⤵
        
        PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
      4⤵
      PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62391.exe
      4⤵
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exe
      4⤵
      PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48813.exe
      4⤵
      PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46491.exe
      4⤵
      PID:4940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10386.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17393.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33112.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19729.exe
        7⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45361.exe
        7⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43629.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        7⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        7⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65400.exe
        6⤵
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18178.exe
        6⤵
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43629.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38793.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13239.exe
        6⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32575.exe
        7⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5909.exe
        7⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11282.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12850.exe
        6⤵
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        6⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        6⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        5⤵
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37043.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
        6⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35466.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27155.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31516.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
        5⤵
        
        PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55140.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29432.exe
        5⤵
        
        PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9595.exe
        5⤵
        
        PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10956.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54811.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
        5⤵
        
        PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35019.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4549.exe
        5⤵
        
        PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-193.exe
        5⤵
        
        PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56343.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43629.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        5⤵
        
        PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
      4⤵
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18907.exe
        5⤵
        
        PID:436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4869.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
        5⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        5⤵
        
        PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51201.exe
      4⤵
      PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64806.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15673.exe
      4⤵
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21315.exe
      4⤵
      PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
      4⤵
      PID:5044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52103.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
      4⤵
      Executes dropped EXE
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        5⤵
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18178.exe
        5⤵
        
        PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26114.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62991.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7541.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        5⤵
        
        PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38186.exe
      4⤵
      PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37774.exe
      4⤵
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8164.exe
        5⤵
        
        PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7495.exe
        5⤵
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46429.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14077.exe
        5⤵
        
        PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe
        5⤵
        
        PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe
      4⤵
      PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
      4⤵
      PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5244.exe
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8690.exe
      4⤵
      PID:5260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50044.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
    3⤵
    PID:2688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
    3⤵
    PID:3052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17341.exe
    3⤵
    PID:3600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23889.exe
    3⤵
    PID:3748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44613.exe
    3⤵
    PID:4232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8690.exe
    3⤵
    PID:5388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24960.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24960.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63500.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1248.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5275.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        6⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
        6⤵
        
        PID:1012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64696.exe
        6⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46643.exe
        6⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
        6⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9722.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34072.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10256.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26445.exe
        7⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17392.exe
        7⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39491.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        6⤵
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54942.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58652.exe
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28679.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        6⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27526.exe
        5⤵
        
        PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28850.exe
        5⤵
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3377.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
        5⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        5⤵
        
        PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36032.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52084.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        6⤵
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15154.exe
        6⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58646.exe
        6⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
        6⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21025.exe
        5⤵
        
        PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        5⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43629.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34652.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11444.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
      4⤵
      PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50677.exe
      4⤵
      PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
      4⤵
      PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
      4⤵
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30187.exe
      4⤵
      PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63640.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
      4⤵
      PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13928.exe
      4⤵
      PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23894.exe
      4⤵
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36632.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
      4⤵
      PID:5108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2954.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45092.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21230.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
      4⤵
      PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
      4⤵
      PID:4364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
    3⤵
    PID:2640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
    3⤵
    PID:1108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47893.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37163.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
    3⤵
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
    3⤵
    PID:4304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35500.exe
    3⤵
    PID:5032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32865.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32865.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49266.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3350.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        6⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21562.exe
        6⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        6⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53769.exe
        6⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62250.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
        6⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        6⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55512.exe
        6⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        7⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64889.exe
        7⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        7⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        7⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        7⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50659.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9970.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62991.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        6⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62555.exe
        5⤵
        
        PID:852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24802.exe
        6⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51870.exe
        6⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62315.exe
        7⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-694.exe
        7⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42106.exe
        6⤵
        
        PID:740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39651.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe
        6⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
        5⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6785.exe
        5⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36183.exe
        5⤵
        
        PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        5⤵
        
        PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10428.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18855.exe
      4⤵
      PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15460.exe
      4⤵
      PID:572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62089.exe
      4⤵
      PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27600.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
      4⤵
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55140.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11186.exe
      4⤵
      Executes dropped EXE
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65534.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51526.exe
        5⤵
        
        PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12847.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19450.exe
        5⤵
        
        PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
      4⤵
      PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe
      4⤵
      PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53769.exe
      4⤵
      PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
      4⤵
      PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe
    3⤵
    - Executes dropped EXE
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18577.exe
      4⤵
      PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
      4⤵
      PID:320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
      4⤵
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14530.exe
      4⤵
      PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30985.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61244.exe
      4⤵
      PID:4408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
    3⤵
    PID:2720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
    3⤵
    PID:480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22398.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22398.exe
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44159.exe
    3⤵
    PID:3652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30187.exe
    3⤵
    PID:4416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34147.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34147.exe
    3⤵
    PID:5188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17127.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17127.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50309.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23900.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23900.exe
    3⤵
    PID:960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52264.exe
      4⤵
      PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38802.exe
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exe
      4⤵
      PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
      4⤵
      PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
      4⤵
      PID:4192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
    3⤵
    PID:236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15450.exe
    3⤵
    PID:3204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
    3⤵
    PID:3920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe
    3⤵
    PID:4908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59128.exe
    3⤵
    PID:4832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
    3⤵
    PID:4424
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7362.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7362.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22785.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58955.exe
    3⤵
    PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe
      4⤵
      PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61470.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
      4⤵
      PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
      4⤵
      PID:4444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13928.exe
    3⤵
    PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11538.exe
      4⤵
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28370.exe
      4⤵
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8212.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20907.exe
      4⤵
      PID:4188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48398.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48398.exe
    3⤵
    PID:3436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3357.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3357.exe
    3⤵
    PID:3552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38807.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
    3⤵
    PID:4112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16774.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16774.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19390.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19390.exe
  2⤵
  PID:1972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
  2⤵
  PID:580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10297.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10297.exe
  2⤵
  PID:3432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53236.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53236.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3284
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28016.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28016.exe
  2⤵
  PID:4824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9707.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9707.exe
  2⤵
  PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1248.exe

Filesize
468KB

MD5
d5102e82e1a580a6996ce183418cbf81

SHA1
28362b866569b81cd33b8501dc3aa70d63703de9

SHA256
0be7f4ced1adc97881ddd833bf87cd48c22b824e748bcc1de68c21e6e8b4ede4

SHA512
528743658896ed9be9d7cfde1e91bbc64c7f1f5f86104a24626554ecdbfe5f97a2ed8d0fdaa02e4cf9ced8460004876889b78403467e62ffe382599b00607e3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe

Filesize
468KB

MD5
866c610b5bb03f1a6501442b130d2bbb

SHA1
aa611102f0dffc46fb80ecc05de78eac543e7673

SHA256
400e21c3dcf6458918871e0e529c815f78aa44611669fe43217e7ad39d2b2b22

SHA512
450587d40ee9f523a8e7015967f4f0686cb00161a500b31b32cdf1220b6fcd7c9e373081e62452be1b92ab45983d4d87b5c79370fd82542413dd23c0a7295141

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17393.exe

Filesize
468KB

MD5
5765191a78fc5cbe4394350ffaa01064

SHA1
c2e29314dae5844d5e84e4a798e831a3cab6694b

SHA256
195a2d8d9940456165cfa20aa742f09bc66a431eb70d011cfcc8279d87199cc1

SHA512
32e49df6b7a1c902f1d5ed9c701aa6a347a7215fd8919a98de1734d5eda571aa876b8e744911552ce0bfd80a6970ae21f15598ddd505937f052dbe3d2d5ca56a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe

Filesize
468KB

MD5
b9720b59086a19978c493b813418ff53

SHA1
6e138f9e6e3085d12d1de802d3cbd053c983b77f

SHA256
782eccf9469d1cb9c6e555c07fc3aeaadb80a4753a524235ce2800318d18d1f3

SHA512
610b9018007c9cc3055f695663fb2c20db6875465954906d3ac415d3d2a7aa6f71f80ac768cb99183c7f495898e149e4669151ea5fdd21635f5427de0e02f5e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24518.exe

Filesize
468KB

MD5
1d0e34536a4cbea85c258587aaa45892

SHA1
39ffaf130fc777ef1e653592c4b8b9b029370345

SHA256
3bd93d348f561b214e963a295a9776f8073145a628e84818c4eb45510d70ad40

SHA512
54dec3ee46a373c4885e9e8ed07a3995bb2e3761801f72e5255584cca811ba95cfee09e5b53d6c0752d98d94048610a9d8f9b6884b29214976820dbe180d7598

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24960.exe

Filesize
468KB

MD5
2f9e7f14e7fd7c2d974eb04ad00a6353

SHA1
43efea6f2dab5b5a2e7f458d62e3116d31b0b9a7

SHA256
5a263e05029cddbc64728075ebea7c45d3fe0a454b0ccc1c6c7805cfc9cc07d7

SHA512
ff90af2626e242d20d8d7e63d92772d9b6caa23d4c933ca249bbfe0f44d8c06f5de2c83d500f31c911bcf05aa33b24eea02e3431bafaed28b1023a7e2c52fb9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe

Filesize
468KB

MD5
700174184d7a1ec656273365bc1e179f

SHA1
913efdace25710f5c86b6969979da8e5880741d6

SHA256
009d830773e07f76207ad33098e80867edac3c2ad18aa06556584f5dfa7fdfc6

SHA512
aef68e07b2a8510988025f1fcd7f321e7c31d0234839c6ef1233a03800fba73959f8bd4ce07e004e774a6759939f4d6410d47c404badae44972406128225a341

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63293.exe

Filesize
468KB

MD5
bbc81a65006d7cba4357ec8309e3d48d

SHA1
a3c110364b19333387c1ffcba139d603b363e82c

SHA256
4c615a103e16a0230a35f42b29e647017c140894c9716c7328f8ed64eddf406f

SHA512
31905c1e36edab46f49becd62760a9f37bba90ec59929407fcb010b177936f411adfa110b99aab6116d6ea09034a507aac87772c88fefd50ba0d72c973f0b0bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63500.exe

Filesize
468KB

MD5
d0f6b430b79ba00214ea5f0bddef0879

SHA1
b8df320565e6cbf8c304a1fee3e1c30247a8b0b4

SHA256
ce098e6e532ff05124616f87742d93b389a109ce56dd5661cfad169bcac754a6

SHA512
1f0b958d4cac4704195b4868923ac5c3afb9d5e4e916ff143a1cd1b4b8724aee1d62b894d0880a5478a178b3677559cb0f875d9fe3a06e992f80c68e93d913fa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10386.exe

Filesize
468KB

MD5
8b55bc05ef182a02350a4b7e66e1f11f

SHA1
bb08ef0f08bbf6a1155be533766404c5b6c497c0

SHA256
0e5de29597fa3dc627d68a38b87c44ac9ba862b508473df133b33eb49b1e29b7

SHA512
1f3bc0496604a3d39556cddafc18e1ad8940e49e187f78219a859751526904be2b68b5257977a0b2f096ea0af20a8c8a94811dff212964f7ebe452013004220f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10814.exe

Filesize
468KB

MD5
8fde9a66135d9403ee1ad8b6afa3c36e

SHA1
cc9085da3036b650ca4015e2570053f713f08c29

SHA256
0b7f04b902f44a4d14da3083d92f6793da7dab50787294891ee6a54aa6982f8c

SHA512
a8880c9aa1d0b2a96821fe815904d4491ea50414cc927942812c53a96d78d6ed2bf2b610396fedd6845b59fb289b18084cf1db783d9f2bb7dd293cd1b1932668

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12052.exe

Filesize
468KB

MD5
164c4b998c03f0c9c3971ce22c7a5177

SHA1
1913d8b6a2b0778ca78215e7ff5752cd1d89c655

SHA256
5c1a631376dd0c1ca7b205c0f4ce4c96b6886c437dc6c668127c45401d14e348

SHA512
8f38aa3e6c27a3dc45ee3ee597d53372883de70ffa01953e459f7241215071c3645470c7058bc574ac79771d774970d3ef53eaa262ed0b9a373f5553d8fc3b91

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17127.exe

Filesize
468KB

MD5
5811b216384486c5832512a581b2b35f

SHA1
3d5e2cf72498a142f7e261646384b982a1f4b336

SHA256
ae04a8ed7b784d34d0bf1ae34c268ade895dae19a78ab21d88a2139b8e2ac9c4

SHA512
cf536e38408583287553e6df61692871580a8394b55bd7483938786427e9036bd25da6990693a7ffa2179251cfa64a0d92ae8d019e158c2298788a7e98f794b2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32865.exe

Filesize
468KB

MD5
6c2e2276747e1dca33cc881519d84960

SHA1
d3756a8dde89967649964352050d6cb47c9a5e3e

SHA256
a731af954db30e7b43489e8840bf495b7d0fdbe31e5c71be430a81e57f37e34d

SHA512
81e5626c97b11258dab7d08cacfc2454b25e18175a1b19cb07d15f219b6cc4c0b83650400dde26160c7aef8311989aa95f92eaa498ca41284e95456bed0f03a0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41377.exe

Filesize
468KB

MD5
8c228043b30df12963cddc6cee1abe0e

SHA1
fb705facd475e884624948752349e040818907eb

SHA256
72871041bdd6198a79ee4bd78039209429af182d8ab0d11599d793fcc0b22c9f

SHA512
38d1936e5720618e926cb803851443ba83c4fb7c5c0c449025370537e0f97e63f0ca527f494fc11adbdd543c7631fde32dde5eecb6ff32eeaf1f6bb2a3ef8523

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe

Filesize
468KB

MD5
10d67805fd3786f9b6fe83155f8bc213

SHA1
90d45994ee474b0e87e5c751fea40d6b26d6410c

SHA256
fd9b861fa27ab7af5e2f4fcf5deb2e2a9326a0b9f911743ace3056d06bb0ab2f

SHA512
9e76c76f36fbe134a7dfcee7bfd39bc262fbc7c7f5739c4125e8bbf804a9d5e783869365f61119327a57d93fc360803a1fbf5770132d64868fa50542c1b693cb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52103.exe

Filesize
468KB

MD5
2f813f60699462b574787da9189cf650

SHA1
d570737042dcd84d39268f0c39177ac6299f2c7f

SHA256
e4f4cc5c0454d0d3cb84ddbbda1b24966c3d43bc7ada443e94cdb3e1c426b257

SHA512
8e721357a02a257fec5b8d6e2846ff2016499ff35c338e2e0c95d5c806f3a12111261843d526fb531e0637c9efe6548200fc60b3dfccfc15f49b20636434e96b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe

Filesize
468KB

MD5
427a513a3f94fffc1211851fd1545bd5

SHA1
558d2e77118b350f7aa3b801dc354f78138ffdc1

SHA256
18820ec192cba403d8eb7e52ccd1e01c2c7688676f319a8cc5a56079e3f9b30a

SHA512
dd8ef1b3e3bafb4423be03784559ec24e17f4d406a78c1ced55d97e6c6e11c02e0f8953e897fed69a094709ecf591769dd5c4cec799bc129715373f1a2624fae

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63640.exe

Filesize
468KB

MD5
70cdf95991645fab1318d6c10f36ec7e

SHA1
80b1dace6d120fdf2cf0a88094dd92da99147a3a

SHA256
69e0826b5ea4f26e1c8d338fbacace9cac6c6ac8b4c55828cd672141b59c4783

SHA512
bb69e7f460bf22a6cdb4a059bd8c8665317f139cf41089704fa29e50b0c31def554c778ab1bc31c836caace4bbf937f3ac832c1f6d3791e69a66246333afae7f

Download Submit
memory/612-305-0x0000000001CD0000-0x0000000001D45000-memory.dmp

Filesize
468KB

Download
memory/612-168-0x0000000001CD0000-0x0000000001D45000-memory.dmp

Filesize
468KB

Download
memory/612-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/612-306-0x0000000001CD0000-0x0000000001D45000-memory.dmp

Filesize
468KB

Download
memory/612-169-0x0000000001CD0000-0x0000000001D45000-memory.dmp

Filesize
468KB

Download
memory/732-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/736-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/736-326-0x0000000000520000-0x0000000000595000-memory.dmp

Filesize
468KB

Download
memory/736-325-0x0000000000520000-0x0000000000595000-memory.dmp

Filesize
468KB

Download
memory/1264-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1348-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1608-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1608-272-0x0000000000680000-0x00000000006F5000-memory.dmp

Filesize
468KB

Download
memory/1608-271-0x0000000000680000-0x00000000006F5000-memory.dmp

Filesize
468KB

Download
memory/1644-395-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1644-396-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1644-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-296-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1712-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-297-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1740-307-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1740-308-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1740-146-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1740-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1740-151-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1892-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1892-328-0x0000000003390000-0x0000000003405000-memory.dmp

Filesize
468KB

Download
memory/1892-331-0x0000000002860000-0x00000000028D5000-memory.dmp

Filesize
468KB

Download
memory/1944-347-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/1944-37-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/1944-346-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/1944-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1944-83-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/1944-165-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/1944-5-0x0000000003440000-0x00000000034B5000-memory.dmp

Filesize
468KB

Download
memory/1944-12-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/1944-166-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/1952-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1988-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1988-376-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/1988-378-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2128-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2168-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2252-352-0x0000000001EB0000-0x0000000001F25000-memory.dmp

Filesize
468KB

Download
memory/2252-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2252-357-0x0000000001EB0000-0x0000000001F25000-memory.dmp

Filesize
468KB

Download
memory/2392-365-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2392-361-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2392-205-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2392-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2392-203-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2460-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-250-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2572-251-0x0000000001DA0000-0x0000000001E15000-memory.dmp

Filesize
468KB

Download
memory/2572-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2584-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2660-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2700-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2700-232-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2700-231-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2716-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-245-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2744-66-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-246-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2824-50-0x0000000001D50000-0x0000000001DC5000-memory.dmp

Filesize
468KB

Download
memory/2824-261-0x0000000001D50000-0x0000000001DC5000-memory.dmp

Filesize
468KB

Download
memory/2824-26-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-260-0x0000000001D50000-0x0000000001DC5000-memory.dmp

Filesize
468KB

Download
memory/2828-332-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2828-175-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2828-24-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2828-25-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2828-330-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2828-181-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2880-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2884-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2900-38-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2900-286-0x0000000002380000-0x00000000023F5000-memory.dmp

Filesize
468KB

Download
memory/2900-287-0x0000000002380000-0x00000000023F5000-memory.dmp

Filesize
468KB

Download
memory/2900-65-0x0000000002380000-0x00000000023F5000-memory.dmp

Filesize
468KB

Download
memory/2900-134-0x0000000002380000-0x00000000023F5000-memory.dmp

Filesize
468KB

Download
memory/2900-133-0x0000000002380000-0x00000000023F5000-memory.dmp

Filesize
468KB

Download
memory/2960-387-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2960-51-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-101-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2960-386-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2960-219-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2960-216-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2980-275-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2980-136-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-284-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3004-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download