163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51

Analysis

max time kernel
116s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe
Size

468KB
MD5

62a6673717009e70f380628335d0a690
SHA1

304c1c3e6442ed85f3da1b3b7800f84f4b6b2a0a
SHA256

163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51
SHA512

d9e617cc9fe0bd7157f86cf630673cfd62eda36785d4538cf770a21ab772905d0c2cd854a8870c8f1d31c9b3efd9988fd6b008b0f1e72cdad8cbacc90f7565cf
SSDEEP

3072:O4Nhogjdpy8Un+HsPz5FvficfhjWI8JnWHevVpA22u39sYNdilt:O4fouLUnfP1FvfExfo22kWYNd

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2916	Unicorn-12636.exe
2160	Unicorn-15023.exe
2872	Unicorn-19662.exe
2520	Unicorn-13565.exe
3024	Unicorn-34924.exe
1616	Unicorn-45453.exe
2716	Unicorn-51583.exe
2412	Unicorn-8708.exe
1928	Unicorn-54956.exe
1568	Unicorn-58293.exe
2384	Unicorn-11012.exe
2512	Unicorn-4882.exe
1552	Unicorn-27660.exe
2920	Unicorn-19757.exe
2296	Unicorn-15952.exe
2392	Unicorn-40307.exe
828	Unicorn-30529.exe
2888	Unicorn-58563.exe
560	Unicorn-15838.exe
1728	Unicorn-3917.exe
636	Unicorn-8952.exe
1688	Unicorn-8952.exe
1672	Unicorn-47446.exe
1612	Unicorn-53576.exe
1092	Unicorn-53311.exe
2768	Unicorn-5807.exe
1716	Unicorn-25673.exe
1028	Unicorn-5807.exe
3048	Unicorn-15590.exe
2192	Unicorn-50198.exe
2692	Unicorn-21780.exe
1896	Unicorn-38308.exe
2988	Unicorn-42030.exe
2704	Unicorn-12844.exe
1772	Unicorn-13934.exe
2868	Unicorn-13934.exe
1300	Unicorn-32116.exe
2564	Unicorn-32116.exe
768	Unicorn-48527.exe
1412	Unicorn-64790.exe
2036	Unicorn-64863.exe
2592	Unicorn-32383.exe
1576	Unicorn-20685.exe
2932	Unicorn-53550.exe
2396	Unicorn-39975.exe
3040	Unicorn-64214.exe
404	Unicorn-18268.exe
860	Unicorn-10483.exe
524	Unicorn-42772.exe
936	Unicorn-34417.exe
1656	Unicorn-37026.exe
2968	Unicorn-46835.exe
2452	Unicorn-1163.exe
984	Unicorn-44042.exe
2828	Unicorn-25668.exe
1492	Unicorn-25668.exe
2736	Unicorn-30690.exe
2728	Unicorn-33258.exe
2636	Unicorn-8428.exe
2996	Unicorn-61692.exe
2852	Unicorn-42563.exe
2252	Unicorn-57053.exe
2972	Unicorn-40525.exe
2732	Unicorn-19035.exe

Loads dropped DLL 64 IoCs

pid	Process
2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe
2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe
2916	Unicorn-12636.exe
2916	Unicorn-12636.exe
2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe
2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe
2160	Unicorn-15023.exe
2160	Unicorn-15023.exe
2916	Unicorn-12636.exe
2916	Unicorn-12636.exe
2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe
2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe
2872	Unicorn-19662.exe
2872	Unicorn-19662.exe
2520	Unicorn-13565.exe
2520	Unicorn-13565.exe
2160	Unicorn-15023.exe
2160	Unicorn-15023.exe
3024	Unicorn-34924.exe
3024	Unicorn-34924.exe
1616	Unicorn-45453.exe
2916	Unicorn-12636.exe
1616	Unicorn-45453.exe
2916	Unicorn-12636.exe
2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe
2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe
2716	Unicorn-51583.exe
2872	Unicorn-19662.exe
2716	Unicorn-51583.exe
2872	Unicorn-19662.exe
2412	Unicorn-8708.exe
2412	Unicorn-8708.exe
2520	Unicorn-13565.exe
2520	Unicorn-13565.exe
1928	Unicorn-54956.exe
1928	Unicorn-54956.exe
3024	Unicorn-34924.exe
3024	Unicorn-34924.exe
2160	Unicorn-15023.exe
2160	Unicorn-15023.exe
2512	Unicorn-4882.exe
2296	Unicorn-15952.exe
2512	Unicorn-4882.exe
2296	Unicorn-15952.exe
2872	Unicorn-19662.exe
2384	Unicorn-11012.exe
2872	Unicorn-19662.exe
2384	Unicorn-11012.exe
2916	Unicorn-12636.exe
2916	Unicorn-12636.exe
2716	Unicorn-51583.exe
1616	Unicorn-45453.exe
1552	Unicorn-27660.exe
2716	Unicorn-51583.exe
1552	Unicorn-27660.exe
1616	Unicorn-45453.exe
2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe
2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe
2392	Unicorn-40307.exe
2392	Unicorn-40307.exe
2412	Unicorn-8708.exe
2412	Unicorn-8708.exe
1568	Unicorn-58293.exe
1568	Unicorn-58293.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3544	2200	WerFault.exe	107
4348	4236	WerFault.exe	307

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57811.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe
2916	Unicorn-12636.exe
2160	Unicorn-15023.exe
2872	Unicorn-19662.exe
2520	Unicorn-13565.exe
3024	Unicorn-34924.exe
1616	Unicorn-45453.exe
2716	Unicorn-51583.exe
2412	Unicorn-8708.exe
1928	Unicorn-54956.exe
1568	Unicorn-58293.exe
2920	Unicorn-19757.exe
2512	Unicorn-4882.exe
2384	Unicorn-11012.exe
2296	Unicorn-15952.exe
1552	Unicorn-27660.exe
2392	Unicorn-40307.exe
2888	Unicorn-58563.exe
560	Unicorn-15838.exe
828	Unicorn-30529.exe
1728	Unicorn-3917.exe
636	Unicorn-8952.exe
1688	Unicorn-8952.exe
1672	Unicorn-47446.exe
2768	Unicorn-5807.exe
1612	Unicorn-53576.exe
1092	Unicorn-53311.exe
1716	Unicorn-25673.exe
1028	Unicorn-5807.exe
3048	Unicorn-15590.exe
2192	Unicorn-50198.exe
1896	Unicorn-38308.exe
2692	Unicorn-21780.exe
2988	Unicorn-42030.exe
2704	Unicorn-12844.exe
2564	Unicorn-32116.exe
1772	Unicorn-13934.exe
2036	Unicorn-64863.exe
1412	Unicorn-64790.exe
2868	Unicorn-13934.exe
1300	Unicorn-32116.exe
768	Unicorn-48527.exe
2592	Unicorn-32383.exe
2932	Unicorn-53550.exe
1576	Unicorn-20685.exe
2396	Unicorn-39975.exe
3040	Unicorn-64214.exe
404	Unicorn-18268.exe
524	Unicorn-42772.exe
860	Unicorn-10483.exe
936	Unicorn-34417.exe
2968	Unicorn-46835.exe
1656	Unicorn-37026.exe
2452	Unicorn-1163.exe
984	Unicorn-44042.exe
1492	Unicorn-25668.exe
2828	Unicorn-25668.exe
2736	Unicorn-30690.exe
2728	Unicorn-33258.exe
2636	Unicorn-8428.exe
2996	Unicorn-61692.exe
2852	Unicorn-42563.exe
2972	Unicorn-40525.exe
2252	Unicorn-57053.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2916	2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe	31
PID 2652 wrote to memory of 2916	2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe	31
PID 2652 wrote to memory of 2916	2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe	31
PID 2652 wrote to memory of 2916	2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe	31
PID 2916 wrote to memory of 2160	2916	Unicorn-12636.exe	32
PID 2916 wrote to memory of 2160	2916	Unicorn-12636.exe	32
PID 2916 wrote to memory of 2160	2916	Unicorn-12636.exe	32
PID 2916 wrote to memory of 2160	2916	Unicorn-12636.exe	32
PID 2652 wrote to memory of 2872	2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe	33
PID 2652 wrote to memory of 2872	2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe	33
PID 2652 wrote to memory of 2872	2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe	33
PID 2652 wrote to memory of 2872	2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe	33
PID 2160 wrote to memory of 2520	2160	Unicorn-15023.exe	34
PID 2160 wrote to memory of 2520	2160	Unicorn-15023.exe	34
PID 2160 wrote to memory of 2520	2160	Unicorn-15023.exe	34
PID 2160 wrote to memory of 2520	2160	Unicorn-15023.exe	34
PID 2916 wrote to memory of 3024	2916	Unicorn-12636.exe	35
PID 2916 wrote to memory of 3024	2916	Unicorn-12636.exe	35
PID 2916 wrote to memory of 3024	2916	Unicorn-12636.exe	35
PID 2916 wrote to memory of 3024	2916	Unicorn-12636.exe	35
PID 2652 wrote to memory of 1616	2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe	36
PID 2652 wrote to memory of 1616	2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe	36
PID 2652 wrote to memory of 1616	2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe	36
PID 2652 wrote to memory of 1616	2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe	36
PID 2872 wrote to memory of 2716	2872	Unicorn-19662.exe	37
PID 2872 wrote to memory of 2716	2872	Unicorn-19662.exe	37
PID 2872 wrote to memory of 2716	2872	Unicorn-19662.exe	37
PID 2872 wrote to memory of 2716	2872	Unicorn-19662.exe	37
PID 2520 wrote to memory of 2412	2520	Unicorn-13565.exe	38
PID 2520 wrote to memory of 2412	2520	Unicorn-13565.exe	38
PID 2520 wrote to memory of 2412	2520	Unicorn-13565.exe	38
PID 2520 wrote to memory of 2412	2520	Unicorn-13565.exe	38
PID 2160 wrote to memory of 1928	2160	Unicorn-15023.exe	39
PID 2160 wrote to memory of 1928	2160	Unicorn-15023.exe	39
PID 2160 wrote to memory of 1928	2160	Unicorn-15023.exe	39
PID 2160 wrote to memory of 1928	2160	Unicorn-15023.exe	39
PID 3024 wrote to memory of 1568	3024	Unicorn-34924.exe	40
PID 3024 wrote to memory of 1568	3024	Unicorn-34924.exe	40
PID 3024 wrote to memory of 1568	3024	Unicorn-34924.exe	40
PID 3024 wrote to memory of 1568	3024	Unicorn-34924.exe	40
PID 1616 wrote to memory of 2384	1616	Unicorn-45453.exe	41
PID 1616 wrote to memory of 2384	1616	Unicorn-45453.exe	41
PID 1616 wrote to memory of 2384	1616	Unicorn-45453.exe	41
PID 1616 wrote to memory of 2384	1616	Unicorn-45453.exe	41
PID 2916 wrote to memory of 2512	2916	Unicorn-12636.exe	42
PID 2916 wrote to memory of 2512	2916	Unicorn-12636.exe	42
PID 2916 wrote to memory of 2512	2916	Unicorn-12636.exe	42
PID 2916 wrote to memory of 2512	2916	Unicorn-12636.exe	42
PID 2652 wrote to memory of 1552	2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe	43
PID 2652 wrote to memory of 1552	2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe	43
PID 2652 wrote to memory of 1552	2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe	43
PID 2652 wrote to memory of 1552	2652	163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe	43
PID 2716 wrote to memory of 2920	2716	Unicorn-51583.exe	44
PID 2716 wrote to memory of 2920	2716	Unicorn-51583.exe	44
PID 2716 wrote to memory of 2920	2716	Unicorn-51583.exe	44
PID 2716 wrote to memory of 2920	2716	Unicorn-51583.exe	44
PID 2872 wrote to memory of 2296	2872	Unicorn-19662.exe	45
PID 2872 wrote to memory of 2296	2872	Unicorn-19662.exe	45
PID 2872 wrote to memory of 2296	2872	Unicorn-19662.exe	45
PID 2872 wrote to memory of 2296	2872	Unicorn-19662.exe	45
PID 2412 wrote to memory of 2392	2412	Unicorn-8708.exe	46
PID 2412 wrote to memory of 2392	2412	Unicorn-8708.exe	46
PID 2412 wrote to memory of 2392	2412	Unicorn-8708.exe	46
PID 2412 wrote to memory of 2392	2412	Unicorn-8708.exe	46

C:\Users\Admin\AppData\Local\Temp\163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe
"C:\Users\Admin\AppData\Local\Temp\163bb18db31920fe002dfd0b90886a3b569e81f1538ceee6983b6845d5e4ee51N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12636.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12636.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15023.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13565.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8708.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40307.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50198.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8428.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
        9⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe
        9⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26717.exe
        9⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        8⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        8⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12940.exe
        8⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
        8⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61692.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2341.exe
        8⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61724.exe
        9⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26384.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
        8⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28884.exe
        8⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 148
        9⤵
        Program crash
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20035.exe
        8⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51983.exe
        8⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14566.exe
        7⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3709.exe
        8⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53714.exe
        8⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        8⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
        8⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56625.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exe
        7⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38475.exe
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37945.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
        7⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24978.exe
        7⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        8⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
        8⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
        8⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52679.exe
        8⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1078.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42004.exe
        7⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26440.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63226.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe
        6⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        7⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39978.exe
        7⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7075.exe
        7⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
        7⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        6⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42144.exe
        6⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
        6⤵
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30529.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13934.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55590.exe
        7⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53246.exe
        8⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25327.exe
        8⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46814.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        7⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47850.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36869.exe
        7⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44014.exe
        7⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-613.exe
        6⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35981.exe
        7⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50984.exe
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        7⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        6⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44395.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61260.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32116.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11140.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40403.exe
        6⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        6⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12910.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14248.exe
        5⤵
        
        PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exe
        5⤵
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38475.exe
        5⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21032.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13693.exe
        5⤵
        
        PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54956.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42030.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40525.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9959.exe
        8⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14410.exe
        9⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        9⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49966.exe
        9⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        8⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47850.exe
        8⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
        8⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47463.exe
        7⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63035.exe
        8⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58015.exe
        8⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49966.exe
        8⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
        8⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        7⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
        7⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51983.exe
        7⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19035.exe
        6⤵
        Executes dropped EXE
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        7⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
        7⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
        7⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52679.exe
        7⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58477.exe
        6⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34006.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20035.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51983.exe
        6⤵
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12844.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63213.exe
        6⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        7⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1668.exe
        7⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
        7⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe
        7⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1078.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38475.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37945.exe
        6⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58536.exe
        5⤵
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        6⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1668.exe
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
        6⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51983.exe
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        5⤵
        
        PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42144.exe
        5⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13440.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
        5⤵
        
        PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48527.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29171.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 216
        7⤵
        Program crash
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12130.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44924.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18542.exe
        6⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
        5⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49994.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7075.exe
        6⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58477.exe
        5⤵
        
        PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34006.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28203.exe
        5⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27478.exe
        5⤵
        
        PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64790.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25170.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13579.exe
        6⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        6⤵
        
        PID:348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1668.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5811.exe
        6⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59191.exe
        6⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33402.exe
        5⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
        6⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
        6⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
        6⤵
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13900.exe
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
        6⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58477.exe
        5⤵
        
        PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23808.exe
        5⤵
        
        PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16417.exe
        5⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        5⤵
        
        PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64480.exe
      4⤵
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39978.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7075.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
        5⤵
        
        PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39141.exe
      4⤵
      PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25871.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48235.exe
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9126.exe
      4⤵
      PID:5408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34924.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58293.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38308.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        7⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61480.exe
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        7⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        6⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51983.exe
        6⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42563.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2588.exe
        6⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        7⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
        7⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7075.exe
        7⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
        7⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29931.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27478.exe
        6⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60953.exe
        5⤵
        
        PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7462.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59070.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65039.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19920.exe
        5⤵
        
        PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13934.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe
        6⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63932.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
        7⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37414.exe
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51983.exe
        7⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33314.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12910.exe
        6⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        6⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8039.exe
        5⤵
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51004.exe
        6⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        6⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53715.exe
        5⤵
        
        PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50065.exe
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24554.exe
        5⤵
        
        PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32116.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34080.exe
        5⤵
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37757.exe
        6⤵
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62064.exe
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61480.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11554.exe
        6⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18192.exe
        5⤵
        
        PID:552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48571.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        5⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37414.exe
        5⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        5⤵
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9694.exe
      4⤵
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49994.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6499.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60655.exe
        5⤵
        
        PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
      4⤵
      PID:3692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
      4⤵
      PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45454.exe
      4⤵
      PID:4896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13693.exe
      4⤵
      PID:6164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4882.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64863.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24236.exe
        6⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52700.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4378.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14043.exe
        6⤵
        
        PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49739.exe
        5⤵
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52198.exe
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58540.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        5⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35224.exe
        5⤵
        
        PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55922.exe
        5⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20130.exe
        6⤵
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41617.exe
        6⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33605.exe
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59383.exe
        6⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4626.exe
        5⤵
        
        PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3382.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58680.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20879.exe
        5⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3511.exe
        5⤵
        
        PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
      4⤵
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23575.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61480.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        5⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14043.exe
        5⤵
        
        PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
      4⤵
      PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25340.exe
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44544.exe
      4⤵
      PID:6096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53311.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18268.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12130.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58680.exe
        5⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61912.exe
        5⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43392.exe
        5⤵
        
        PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49770.exe
      4⤵
      PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48571.exe
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
      4⤵
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12910.exe
      4⤵
      PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
      4⤵
      PID:6212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34417.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40746.exe
      4⤵
      PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
      4⤵
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
      4⤵
      PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
      4⤵
      PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
      4⤵
      PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27257.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27257.exe
    3⤵
    PID:2212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46301.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34010.exe
    3⤵
    PID:4252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52111.exe
    3⤵
    PID:5424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12558.exe
    3⤵
    PID:6292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19662.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19662.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19757.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58536.exe
        5⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
        6⤵
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
        6⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe
        5⤵
        
        PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50914.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53277.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10719.exe
        5⤵
        
        PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5807.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42772.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe
        6⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1933.exe
        7⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58000.exe
        7⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        7⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6817.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12940.exe
        6⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44014.exe
        6⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24375.exe
        5⤵
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55723.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23302.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4514.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59191.exe
        5⤵
        
        PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37026.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12729.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33220.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45662.exe
        6⤵
        
        PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63932.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5811.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
      4⤵
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34099.exe
        5⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe
        5⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37417.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
      4⤵
      PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28514.exe
      4⤵
      PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28734.exe
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55877.exe
      4⤵
      PID:5608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15952.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32383.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53299.exe
        7⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
        7⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13900.exe
        7⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
        7⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16905.exe
        6⤵
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48571.exe
        6⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
        6⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exe
        5⤵
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37155.exe
        6⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
        6⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37720.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14043.exe
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38425.exe
        5⤵
        
        PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54237.exe
        5⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10719.exe
        5⤵
        
        PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53550.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-831.exe
        5⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50435.exe
        6⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
        6⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38475.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37945.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
        5⤵
        
        PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59880.exe
      4⤵
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51099.exe
        5⤵
        
        PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        5⤵
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59194.exe
      4⤵
      PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exe
      4⤵
      PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38475.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13440.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13693.exe
      4⤵
      PID:6260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47446.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47446.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        5⤵
        
        PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14476.exe
        5⤵
        
        PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18000.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48571.exe
      4⤵
      PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20502.exe
      4⤵
      PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
      4⤵
      PID:6668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64214.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe
      4⤵
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54701.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44076.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15710.exe
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        5⤵
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
      4⤵
      PID:988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58540.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54237.exe
      4⤵
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3511.exe
      4⤵
      PID:4556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38881.exe
    3⤵
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62370.exe
      4⤵
      PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
      4⤵
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
      4⤵
      PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29168.exe
      4⤵
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
      4⤵
      PID:5312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31040.exe
    3⤵
    PID:2900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65030.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18588.exe
    3⤵
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12558.exe
    3⤵
    PID:6276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11012.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53576.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10483.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34080.exe
        6⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1419.exe
        7⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
        7⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        7⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47850.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20532.exe
        6⤵
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
        6⤵
        
        PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55631.exe
        5⤵
        
        PID:1360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        6⤵
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61480.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
        6⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58477.exe
        5⤵
        
        PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23808.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25996.exe
        5⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        5⤵
        
        PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46835.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26488.exe
        5⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18832.exe
        6⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
        6⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10189.exe
        6⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        5⤵
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47850.exe
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36869.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44014.exe
        5⤵
        
        PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14566.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43373.exe
        5⤵
        
        PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34263.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
        5⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
      4⤵
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60017.exe
      4⤵
      PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13440.exe
      4⤵
      PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13693.exe
      4⤵
      PID:6156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5807.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1163.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        5⤵
        
        PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52679.exe
        5⤵
        
        PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6729.exe
      4⤵
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58525.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64060.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51527.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41617.exe
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10627.exe
      4⤵
      PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27478.exe
      4⤵
      PID:6024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44042.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9959.exe
      4⤵
      PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        5⤵
        
        PID:304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39978.exe
        5⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        5⤵
        
        PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
      4⤵
      PID:532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20502.exe
      4⤵
      PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
      4⤵
      PID:5672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9694.exe
    3⤵
    PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51850.exe
      4⤵
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
      4⤵
      PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39244.exe
      4⤵
      PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
    3⤵
    PID:3672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28514.exe
    3⤵
    PID:3200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28734.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28734.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23013.exe
    3⤵
    PID:6000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27660.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27660.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25673.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25668.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56506.exe
        5⤵
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        5⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34693.exe
        5⤵
        
        PID:6488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36640.exe
      4⤵
      PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48571.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
      4⤵
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5235.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51983.exe
      4⤵
      PID:5212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30690.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3016.exe
      4⤵
      PID:444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21308.exe
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8524.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        5⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6817.exe
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12940.exe
      4⤵
      PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
      4⤵
      PID:5600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64727.exe
    3⤵
    PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
      4⤵
      PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47745.exe
      4⤵
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8035.exe
      4⤵
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
      4⤵
      PID:5604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
    3⤵
    PID:3780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11225.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28388.exe
    3⤵
    PID:4944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35608.exe
    3⤵
    PID:6480
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15590.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15590.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25668.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe
      4⤵
      PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58328.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31944.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35796.exe
        5⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37850.exe
        5⤵
        
        PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
      4⤵
      PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14025.exe
      4⤵
      PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51990.exe
      4⤵
      PID:5492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-831.exe
    3⤵
    PID:108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61480.exe
      4⤵
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
      4⤵
      PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35077.exe
      4⤵
      PID:6424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58477.exe
    3⤵
    PID:2380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58680.exe
    3⤵
    PID:4600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61912.exe
    3⤵
    PID:5536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35224.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35224.exe
    3⤵
    PID:6088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33258.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33258.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
    3⤵
    PID:1948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
    3⤵
    PID:2616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47724.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30578.exe
    3⤵
    PID:6660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51059.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51059.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1048
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24770.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24770.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28675.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28675.exe
  2⤵
  PID:4160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56312.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56312.exe
  2⤵
  PID:5352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18647.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18647.exe
  2⤵
  PID:5196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe

Filesize
468KB

MD5
660ea6b4278fd57e00a8eba228c5f28e

SHA1
108844088254369e4f0b56b7e76bed243e039a54

SHA256
84d326584057d4542d13a918561a82d9d856b3fd9b277aa014700f8a389695e1

SHA512
1ff5c4b04f3760fde8ea9f9797829a7ee7e8e2e09fb656ce294c4c939624101416c1c2509f265939578cfb8028a12629b0f67b48bafe8fa9d91fe4c74bb8c464

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27660.exe

Filesize
468KB

MD5
3cab2d483f035c425183b6c6955f46a2

SHA1
de68424d70066bb69371002dca7fd05b00e6b480

SHA256
8f3352596a0e9b8d7f5329b7d30b3b8c1a51e27d4921021968763c2897a4781e

SHA512
181c0ece6d7ec60f54e5a2dd41cb8933f5490bfddaae8435c8c7bdbf91f50ac7b701933be3605aa035da650c98c73f605f86bbbf17c2bd86f2f60a9057aa7e46

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4514.exe

Filesize
468KB

MD5
b0a5e9e509b8dff10bb4fa3442a284c2

SHA1
be8dc09092aa2872888aeaf5bfce73c038eaccf2

SHA256
cd0ef4ece40e6ccb1bfa0f9fd629808f6650f85a11fc3237744d9ad0eb6083b6

SHA512
27eecfa9585d11b002fb3a80909951790f769eae06fbea181ef1d371d43d6e8de65fa9716e67391435cdbef95bb392f5fade242b1c230f4229a8f24e166ab915

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe

Filesize
468KB

MD5
bbd37b3f7962449cdb56d4ab5f9113aa

SHA1
4851d140d9d724ed0fa09baa9078815cd9322630

SHA256
33afeb93501c5e6caf8ff3458d7b4805af84d88ef686574248d83a28093b1cd2

SHA512
40508c9b28ba9c8d7e704988c3bdbdd4a25aae622fef70c6c746a35c1587394cf6a6c0f81b42d3d3f0dd790f86c314150680dff0287110eb69fa9ba8ec011125

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54701.exe

Filesize
468KB

MD5
2f4b08e3a4be471de15fefbe60ad1842

SHA1
d0b6b381980843a42ae23ed2e934662da7c429de

SHA256
e355f7e2d57e3605807a84ea9d8d37a5e6e2368e1d8d7df889c03d06a2751b08

SHA512
ba02a08588a26d64476552782065c1099b6661793ac45fe6b6a1d722b7cfb9822e73bf6ee4f8632aa9d1219ff50fdaf7d8c9a6f7e502c4e424ea1a7ef974842f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exe

Filesize
468KB

MD5
93e1afc6d29d1027b0938158bf974fa5

SHA1
8f45190442cfd72ff0b00d834c807de9edabb1e1

SHA256
78889107205ab921d996405052caf1747251d8d38af4d8e6b50cbcc75d5da83f

SHA512
0421193233a9120fd5fbbe46d59d51cc72deb42c954212e6d43bb9af7ba236e055134cc7d961988ead89e5b9790dafb05e89406eef6c45e544b8ccfc73a1ab07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58293.exe

Filesize
468KB

MD5
50dd3eb56c229125bc40e3126a33b4a1

SHA1
4ab9ac829f44391bf9dadd7abad7f35c6fcd7d8b

SHA256
fe7c49423f55c6d8bc399f5d6b213f93feec272161d4d51fe71fafc705763aea

SHA512
c16fb61651c34724054c5b2c69e5c5bbae1c1a810d18d43dc4832657a934bdb3f60349b0870bc84ca026783b65516496bb580e72e585950671b5383fe4220a84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe

Filesize
468KB

MD5
520cfbd4f887c5f23e373ff70ca9be74

SHA1
6fe67b66abcb80f6aa885e5597ab12387242115d

SHA256
b65b65d0db57209f5915af7214db257b0bb866f21662597efdddd3ef7ccc193e

SHA512
ab7e28f123e889916844832704ad65b1666fd030a14bc70a93302dd40bd428987375fd65c430b80927b06fae44964ec588d1acf3095c917c20e4364af0912980

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11012.exe

Filesize
468KB

MD5
e217fa2a5f50729a935c38e0ab63c63d

SHA1
06c9716dc5c3b0e37fa246ea6f9f90fb24a63bce

SHA256
363edace4e94ed88efacc44c3051479dd0cf4a408ef3e81e10c2ad7b238a4003

SHA512
5e320af98deaffadaff060221f5cf27c933f14d1af462b26c3d0adc8fb1483fd90ae181d9b5cd86d1808c55f8938d9d854286a983280fbe53a66987472f20eb1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12636.exe

Filesize
468KB

MD5
fe3ff9535748a90281d4e87a1ccf4c85

SHA1
1f8b3f82915e66899ae359213f60c5afdc5e725b

SHA256
b04868455bccdb79877cad841a089938b4f33de59c5a091ddcf5b3d6e9ca0656

SHA512
48273a16324e1dd7da4cb872f538d724697efbd57d3d1cc908e08ad8b9861e49e5c0989b9aa3a42562bd8a757387e081c088263b34eb8a009aaecc7b91a84b78

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13565.exe

Filesize
468KB

MD5
b0f215f89f51239983eb448eab2d98aa

SHA1
228e30e14e052968bcd9e72c4d8ad37ad547bdd4

SHA256
837aa3df28c9dbb60f286fca1ea5c5302d8b952943726e8c44472d60d6d4c731

SHA512
4b25bd127f3a091e255b962867ef6e637939880b362b427364c8779872af8146153158f80aade6fb6b0d74ca1553e396046e18a64cff5bca19ea8b883729943f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15023.exe

Filesize
468KB

MD5
89b1de1ff6af505e186e675126ceffeb

SHA1
0e5582e0ab5d3af26125e48d0f371643b944e36a

SHA256
8614e4f5f274f6b368c07c8a579d87cd3bef0084c3eed96fe32ed905b6467c8c

SHA512
443ec4ebe22229b1c3a42941983a5bee7c3363e7a84108f5ddff306db4bd20e232b4258b8ddbdf7fb174f698ff6b8ab15d628100adf91c51ef72c6a5bd15fa7b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15952.exe

Filesize
468KB

MD5
fd39d5ae694cd7f7642b1b63dff43279

SHA1
3bf18844c902c913a3701cc8f0f04a6c7fdcce62

SHA256
6b7b68d0ccf26234b432642bda13f54deea82062f455607a52d27c0823a01a73

SHA512
ba0c6d0bb32567c44020057c210a28e9d454b49d3eb384c48e577f7665f8aca7b8259c086cb94ade950245ce797a081cb53081742a5717663fe4498d1fcb94c6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19662.exe

Filesize
468KB

MD5
87348fc5c0d8c613ea36989cc4c89ea6

SHA1
133e5ba72bea92deb66fe62a056d6d6279256a23

SHA256
fb0cf9d96023faa515aa48ea39ebf8f2bf193ba9d8792e70bc29759c3812e2e9

SHA512
6c912c1c8000de44e7004bf7bcc62e10379cffb7c8bfa890d9e5881116fd3e8249dda464688e9ae0f2fada9c62a8c50fdfcc89c3a4338e3e0c20ef764134ff2c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19757.exe

Filesize
468KB

MD5
994e0fc2af0d57cae826d1861f6d9879

SHA1
fd782630efd70178978a0feabdb5c8b600eb7a5b

SHA256
b284222436d04a1e772ef6e2df07b8f6b46a14839ef1db78712a896808d03513

SHA512
71948279b4e8966f909648e6aac95b35478b44c2b0dd48de3995c168a007576ae4190a751a47214764a350f0feab9342322d9288465ba6b6734fddc3c30bacc9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30529.exe

Filesize
468KB

MD5
bc8190160a9824fb625150295652be4c

SHA1
e4d0f4cdbbe7bd54c155c3b64de476bc48da9a2b

SHA256
b0ddc9f5a17a9cc99039a11c94f1d76f03c54afea1925be8445c6a1a58649ebb

SHA512
8c0759a2c708b62c1558a551420f15f7afe4ff5f66a3990c8374102983db607a848b9bfb63eba2af8fdc85844b9fddb1d974a39da45603f03a3ee0b2b7fdf85f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34924.exe

Filesize
468KB

MD5
6af4adfa47f9df31faaab32d0d25f6bd

SHA1
b81fa9cebfa8e2bdd05c2ada38ae11eedd3f2a94

SHA256
1966e51abdacca191813aecb422e08b6b0aa9f6406e539b2987a49f8a0093ae9

SHA512
78394a2f3ef9d3c3f1c1c32bb6aa472d134270a2ef23a6f710647d9c6eb1248a0bd2144b3a1404088ef3f7b28e2a91f6bb1c7aa0c0ab2e405627099a27966119

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40307.exe

Filesize
468KB

MD5
28565f0116b668a88544f22eba8f40a0

SHA1
dab73a98fd3d5b69ceaa0ee02f8b7fce09f3739b

SHA256
da1c0dbeb4e9d69fd7bd8cbe69466c2fced1fd0c912c9b79d63f0eb0bcfc3c70

SHA512
0cb512bab0fd5766c47bb0e736bf9c5147c74f7fdbbddaf4022872fdce074635743ba3abf1ac91e6a2dda124e4cfc45434a88566d652cd40038f69638b9fc544

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4882.exe

Filesize
468KB

MD5
710ac2bf40338308f7db0c46e0139f16

SHA1
2d5b8396477794d7e3efb0a1f58ddc4b84b60d44

SHA256
bb8a037c9a3a367d72648a9db285d33c072a9a86e81a831939c0b9e16e511952

SHA512
62b3eb9ce484989c484aa4e471476285bcafb74cc472ceac1cbc7f3931df4035e1a210c7533f5fe61ddb26955fd3080b2a249c84499bff3fb8e114ca464c43ad

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe

Filesize
468KB

MD5
6cc82f80d4ecbe70248488c32daeae16

SHA1
f622d3164babd0a813a0375f646b927a8e86af5a

SHA256
c38a035f7aea6cc4d883c7c2b55fb3abb335e7ffd1879cedbe90bb9ed104ff94

SHA512
62172e0886e985c4a674308bdf4b7fe37eb1c82958778be30c06b102547767a8751097e6e8b1a057cdbe2f33507e764210282c10de5ad21f222d91daf004a498

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54956.exe

Filesize
468KB

MD5
4539bb8d98b1c4a2a2560bb5b42d6d51

SHA1
ca7d92addc456421c9b39cf93a57377dfcf800ad

SHA256
e34294ca0a5a4712ebc19050550c8eeadb0e067037ce00e018c0d10c00abe18d

SHA512
ba58993fb20645b6c5174456e11dafc13c553932c3bcccad134d949fef07cacb6e5753c41958905a4b02df567846f9106bd8aeac8ef9ed2a23f18b092122eff5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8708.exe

Filesize
468KB

MD5
b303b452d4d768e450a49cbc45f96e5d

SHA1
af47f35647538511d4a4fe3b0e0673a35d0fed66

SHA256
2a03918acee19fda02f7227f11968ea3337bf0f97d30d4ca53d6898adef01e85

SHA512
1dfee9f12fe5652856da292afbd9cd811e770be7c08575387128ad86d32a04ffb4e0e7d499e7f5eec8fd6d768526f97150cd3c3951b7c5b0492f984ffb46d11e

Download Submit
memory/560-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/560-382-0x0000000003780000-0x00000000037F5000-memory.dmp

Filesize
468KB

Download
memory/636-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/828-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/828-381-0x00000000037B0000-0x0000000003825000-memory.dmp

Filesize
468KB

Download
memory/1092-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1552-302-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/1552-156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1552-294-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/1568-349-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1568-348-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1612-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-149-0x0000000002C40000-0x0000000002CB5000-memory.dmp

Filesize
468KB

Download
memory/1616-303-0x0000000002C40000-0x0000000002CB5000-memory.dmp

Filesize
468KB

Download
memory/1616-292-0x0000000002C40000-0x0000000002CB5000-memory.dmp

Filesize
468KB

Download
memory/1672-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1716-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1728-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1772-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1896-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1928-371-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/1928-372-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/1928-228-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/1928-227-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/1928-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-250-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2160-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-248-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2160-48-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2160-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2192-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2296-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2296-257-0x0000000002D90000-0x0000000002E05000-memory.dmp

Filesize
468KB

Download
memory/2296-258-0x00000000038C0000-0x0000000003935000-memory.dmp

Filesize
468KB

Download
memory/2384-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2384-278-0x0000000002710000-0x0000000002785000-memory.dmp

Filesize
468KB

Download
memory/2392-330-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2392-332-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/2392-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2412-341-0x0000000001DC0000-0x0000000001E35000-memory.dmp

Filesize
468KB

Download
memory/2412-199-0x0000000001DC0000-0x0000000001E35000-memory.dmp

Filesize
468KB

Download
memory/2412-198-0x0000000001DC0000-0x0000000001E35000-memory.dmp

Filesize
468KB

Download
memory/2412-337-0x0000000001DC0000-0x0000000001E35000-memory.dmp

Filesize
468KB

Download
memory/2412-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2512-259-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2512-256-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2512-155-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-98-0x00000000038A0000-0x0000000003915000-memory.dmp

Filesize
468KB

Download
memory/2520-212-0x0000000002D70000-0x0000000002DE5000-memory.dmp

Filesize
468KB

Download
memory/2520-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-390-0x0000000002D70000-0x0000000002DE5000-memory.dmp

Filesize
468KB

Download
memory/2520-211-0x0000000002D70000-0x0000000002DE5000-memory.dmp

Filesize
468KB

Download
memory/2652-311-0x0000000002CF0000-0x0000000002D65000-memory.dmp

Filesize
468KB

Download
memory/2652-151-0x0000000003820000-0x0000000003895000-memory.dmp

Filesize
468KB

Download
memory/2652-6-0x0000000003820000-0x0000000003895000-memory.dmp

Filesize
468KB

Download
memory/2652-12-0x0000000002CF0000-0x0000000002D65000-memory.dmp

Filesize
468KB

Download
memory/2652-75-0x0000000002CF0000-0x0000000002D65000-memory.dmp

Filesize
468KB

Download
memory/2652-152-0x0000000002CF0000-0x0000000002D65000-memory.dmp

Filesize
468KB

Download
memory/2652-373-0x0000000003820000-0x0000000003895000-memory.dmp

Filesize
468KB

Download
memory/2652-376-0x0000000002CF0000-0x0000000002D65000-memory.dmp

Filesize
468KB

Download
memory/2652-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2652-310-0x0000000002CF0000-0x0000000002D65000-memory.dmp

Filesize
468KB

Download
memory/2652-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2716-172-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2716-169-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2716-291-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2716-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2716-301-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2768-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-279-0x0000000002000000-0x0000000002075000-memory.dmp

Filesize
468KB

Download
memory/2872-170-0x0000000002000000-0x0000000002075000-memory.dmp

Filesize
468KB

Download
memory/2872-177-0x0000000002000000-0x0000000002075000-memory.dmp

Filesize
468KB

Download
memory/2872-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-277-0x0000000002000000-0x0000000002075000-memory.dmp

Filesize
468KB

Download
memory/2888-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2888-359-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2888-355-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/2916-60-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2916-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-14-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-287-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2916-290-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2916-137-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2916-32-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2920-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3024-117-0x00000000026C0000-0x0000000002735000-memory.dmp

Filesize
468KB

Download
memory/3024-391-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/3024-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3024-385-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/3024-237-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/3024-233-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/3048-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download