27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe
Size

468KB
MD5

5994706e3c95a78e210d981a1c5b8840
SHA1

8651ae6ba2ac45e6f039d4102ac08c23aff1f28b
SHA256

27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858
SHA512

d3f0b0411f79b1f78bdbf1c60864b104a2e16ce8b8d889c6a4142a6e585c9b579f2e92178f77630bfd94a0d54418ccb4d759794ac309e23cfa9a74443ddf27d7
SSDEEP

3072:bcAWog7d778r/7YfPzsUSx8/9CrQxgpCndHeZV5RiKU6J/H2+9lM:bc5og4r/wPIUSxGcBfiKX5H2+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2552	Unicorn-33340.exe
1740	Unicorn-37507.exe
2348	Unicorn-52452.exe
2840	Unicorn-63163.exe
2764	Unicorn-319.exe
2872	Unicorn-20185.exe
2656	Unicorn-42643.exe
3068	Unicorn-1793.exe
2344	Unicorn-39296.exe
2700	Unicorn-5877.exe
264	Unicorn-20167.exe
2668	Unicorn-52940.exe
2896	Unicorn-24928.exe
2904	Unicorn-5062.exe
2008	Unicorn-24663.exe
2160	Unicorn-63329.exe
2228	Unicorn-39379.exe
1324	Unicorn-59913.exe
2024	Unicorn-506.exe
3060	Unicorn-506.exe
1716	Unicorn-39955.exe
2248	Unicorn-61767.exe
3020	Unicorn-58238.exe
3016	Unicorn-22608.exe
2276	Unicorn-47377.exe
2068	Unicorn-22873.exe
2332	Unicorn-39109.exe
1608	Unicorn-45239.exe
2400	Unicorn-36308.exe
2116	Unicorn-45239.exe
1616	Unicorn-25373.exe
2748	Unicorn-20097.exe
2824	Unicorn-20651.exe
2616	Unicorn-1622.exe
2620	Unicorn-3660.exe
2852	Unicorn-38379.exe
2180	Unicorn-50366.exe
1572	Unicorn-50631.exe
1812	Unicorn-38933.exe
700	Unicorn-58799.exe
1560	Unicorn-47424.exe
2932	Unicorn-3075.exe
2940	Unicorn-54777.exe
2412	Unicorn-19311.exe
2164	Unicorn-52639.exe
1624	Unicorn-837.exe
444	Unicorn-6967.exe
924	Unicorn-6967.exe
1864	Unicorn-41016.exe
1784	Unicorn-43816.exe
1708	Unicorn-49946.exe
2252	Unicorn-39640.exe
1600	Unicorn-19774.exe
1000	Unicorn-39640.exe
1044	Unicorn-36110.exe
2292	Unicorn-18404.exe
2288	Unicorn-38270.exe
1620	Unicorn-38270.exe
2088	Unicorn-25056.exe
2864	Unicorn-5140.exe
2816	Unicorn-5405.exe
2716	Unicorn-36686.exe
2672	Unicorn-54990.exe
1052	Unicorn-6344.exe

Loads dropped DLL 64 IoCs

pid	Process
2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe
2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe
2552	Unicorn-33340.exe
2552	Unicorn-33340.exe
2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe
2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe
1740	Unicorn-37507.exe
1740	Unicorn-37507.exe
2552	Unicorn-33340.exe
2552	Unicorn-33340.exe
2348	Unicorn-52452.exe
2348	Unicorn-52452.exe
2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe
2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe
2840	Unicorn-63163.exe
2840	Unicorn-63163.exe
1740	Unicorn-37507.exe
1740	Unicorn-37507.exe
2764	Unicorn-319.exe
2764	Unicorn-319.exe
2552	Unicorn-33340.exe
2552	Unicorn-33340.exe
2656	Unicorn-42643.exe
2656	Unicorn-42643.exe
2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe
2348	Unicorn-52452.exe
2872	Unicorn-20185.exe
2348	Unicorn-52452.exe
2872	Unicorn-20185.exe
2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe
3068	Unicorn-1793.exe
3068	Unicorn-1793.exe
2840	Unicorn-63163.exe
2840	Unicorn-63163.exe
2344	Unicorn-39296.exe
1740	Unicorn-37507.exe
1740	Unicorn-37507.exe
2344	Unicorn-39296.exe
2700	Unicorn-5877.exe
2700	Unicorn-5877.exe
2764	Unicorn-319.exe
2764	Unicorn-319.exe
264	Unicorn-20167.exe
264	Unicorn-20167.exe
2872	Unicorn-20185.exe
2552	Unicorn-33340.exe
2872	Unicorn-20185.exe
2552	Unicorn-33340.exe
2904	Unicorn-5062.exe
2904	Unicorn-5062.exe
2896	Unicorn-24928.exe
2896	Unicorn-24928.exe
2348	Unicorn-52452.exe
2008	Unicorn-24663.exe
2668	Unicorn-52940.exe
2348	Unicorn-52452.exe
2656	Unicorn-42643.exe
2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe
2008	Unicorn-24663.exe
2668	Unicorn-52940.exe
2656	Unicorn-42643.exe
2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe
2160	Unicorn-63329.exe
2160	Unicorn-63329.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17019.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe
2552	Unicorn-33340.exe
1740	Unicorn-37507.exe
2348	Unicorn-52452.exe
2840	Unicorn-63163.exe
2764	Unicorn-319.exe
2656	Unicorn-42643.exe
2872	Unicorn-20185.exe
3068	Unicorn-1793.exe
2344	Unicorn-39296.exe
2700	Unicorn-5877.exe
264	Unicorn-20167.exe
2904	Unicorn-5062.exe
2668	Unicorn-52940.exe
2896	Unicorn-24928.exe
2008	Unicorn-24663.exe
2160	Unicorn-63329.exe
1324	Unicorn-59913.exe
2228	Unicorn-39379.exe
2024	Unicorn-506.exe
1716	Unicorn-39955.exe
3060	Unicorn-506.exe
2248	Unicorn-61767.exe
3020	Unicorn-58238.exe
3016	Unicorn-22608.exe
1616	Unicorn-25373.exe
2332	Unicorn-39109.exe
1608	Unicorn-45239.exe
2276	Unicorn-47377.exe
2400	Unicorn-36308.exe
2068	Unicorn-22873.exe
2116	Unicorn-45239.exe
2748	Unicorn-20097.exe
2824	Unicorn-20651.exe
2616	Unicorn-1622.exe
2620	Unicorn-3660.exe
1812	Unicorn-38933.exe
2180	Unicorn-50366.exe
700	Unicorn-58799.exe
1572	Unicorn-50631.exe
2852	Unicorn-38379.exe
1560	Unicorn-47424.exe
2932	Unicorn-3075.exe
2940	Unicorn-54777.exe
1864	Unicorn-41016.exe
2164	Unicorn-52639.exe
1000	Unicorn-39640.exe
924	Unicorn-6967.exe
1600	Unicorn-19774.exe
1708	Unicorn-49946.exe
1784	Unicorn-43816.exe
2252	Unicorn-39640.exe
2412	Unicorn-19311.exe
444	Unicorn-6967.exe
1624	Unicorn-837.exe
2288	Unicorn-38270.exe
1620	Unicorn-38270.exe
2292	Unicorn-18404.exe
1044	Unicorn-36110.exe
2864	Unicorn-5140.exe
2816	Unicorn-5405.exe
2088	Unicorn-25056.exe
2716	Unicorn-36686.exe
2672	Unicorn-54990.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2552	2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe	30
PID 2376 wrote to memory of 2552	2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe	30
PID 2376 wrote to memory of 2552	2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe	30
PID 2376 wrote to memory of 2552	2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe	30
PID 2552 wrote to memory of 1740	2552	Unicorn-33340.exe	31
PID 2552 wrote to memory of 1740	2552	Unicorn-33340.exe	31
PID 2552 wrote to memory of 1740	2552	Unicorn-33340.exe	31
PID 2552 wrote to memory of 1740	2552	Unicorn-33340.exe	31
PID 2376 wrote to memory of 2348	2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe	32
PID 2376 wrote to memory of 2348	2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe	32
PID 2376 wrote to memory of 2348	2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe	32
PID 2376 wrote to memory of 2348	2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe	32
PID 1740 wrote to memory of 2840	1740	Unicorn-37507.exe	34
PID 1740 wrote to memory of 2840	1740	Unicorn-37507.exe	34
PID 1740 wrote to memory of 2840	1740	Unicorn-37507.exe	34
PID 1740 wrote to memory of 2840	1740	Unicorn-37507.exe	34
PID 2552 wrote to memory of 2764	2552	Unicorn-33340.exe	35
PID 2552 wrote to memory of 2764	2552	Unicorn-33340.exe	35
PID 2552 wrote to memory of 2764	2552	Unicorn-33340.exe	35
PID 2552 wrote to memory of 2764	2552	Unicorn-33340.exe	35
PID 2348 wrote to memory of 2872	2348	Unicorn-52452.exe	36
PID 2348 wrote to memory of 2872	2348	Unicorn-52452.exe	36
PID 2348 wrote to memory of 2872	2348	Unicorn-52452.exe	36
PID 2348 wrote to memory of 2872	2348	Unicorn-52452.exe	36
PID 2376 wrote to memory of 2656	2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe	37
PID 2376 wrote to memory of 2656	2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe	37
PID 2376 wrote to memory of 2656	2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe	37
PID 2376 wrote to memory of 2656	2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe	37
PID 2840 wrote to memory of 3068	2840	Unicorn-63163.exe	38
PID 2840 wrote to memory of 3068	2840	Unicorn-63163.exe	38
PID 2840 wrote to memory of 3068	2840	Unicorn-63163.exe	38
PID 2840 wrote to memory of 3068	2840	Unicorn-63163.exe	38
PID 1740 wrote to memory of 2344	1740	Unicorn-37507.exe	39
PID 1740 wrote to memory of 2344	1740	Unicorn-37507.exe	39
PID 1740 wrote to memory of 2344	1740	Unicorn-37507.exe	39
PID 1740 wrote to memory of 2344	1740	Unicorn-37507.exe	39
PID 2764 wrote to memory of 2700	2764	Unicorn-319.exe	40
PID 2764 wrote to memory of 2700	2764	Unicorn-319.exe	40
PID 2764 wrote to memory of 2700	2764	Unicorn-319.exe	40
PID 2764 wrote to memory of 2700	2764	Unicorn-319.exe	40
PID 2552 wrote to memory of 264	2552	Unicorn-33340.exe	41
PID 2552 wrote to memory of 264	2552	Unicorn-33340.exe	41
PID 2552 wrote to memory of 264	2552	Unicorn-33340.exe	41
PID 2552 wrote to memory of 264	2552	Unicorn-33340.exe	41
PID 2656 wrote to memory of 2668	2656	Unicorn-42643.exe	42
PID 2656 wrote to memory of 2668	2656	Unicorn-42643.exe	42
PID 2656 wrote to memory of 2668	2656	Unicorn-42643.exe	42
PID 2656 wrote to memory of 2668	2656	Unicorn-42643.exe	42
PID 2348 wrote to memory of 2904	2348	Unicorn-52452.exe	44
PID 2348 wrote to memory of 2904	2348	Unicorn-52452.exe	44
PID 2348 wrote to memory of 2904	2348	Unicorn-52452.exe	44
PID 2348 wrote to memory of 2904	2348	Unicorn-52452.exe	44
PID 2872 wrote to memory of 2896	2872	Unicorn-20185.exe	45
PID 2872 wrote to memory of 2896	2872	Unicorn-20185.exe	45
PID 2872 wrote to memory of 2896	2872	Unicorn-20185.exe	45
PID 2872 wrote to memory of 2896	2872	Unicorn-20185.exe	45
PID 2376 wrote to memory of 2008	2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe	43
PID 2376 wrote to memory of 2008	2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe	43
PID 2376 wrote to memory of 2008	2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe	43
PID 2376 wrote to memory of 2008	2376	27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe	43
PID 3068 wrote to memory of 2160	3068	Unicorn-1793.exe	46
PID 3068 wrote to memory of 2160	3068	Unicorn-1793.exe	46
PID 3068 wrote to memory of 2160	3068	Unicorn-1793.exe	46
PID 3068 wrote to memory of 2160	3068	Unicorn-1793.exe	46

C:\Users\Admin\AppData\Local\Temp\27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe
"C:\Users\Admin\AppData\Local\Temp\27b7d600d5905dc65d58672787c8822183622b5f33564a2ba72d503ea1eeb858N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37507.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37507.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63163.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1793.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20097.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54990.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26677.exe
        9⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12006.exe
        10⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28145.exe
        10⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13137.exe
        9⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31493.exe
        9⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe
        8⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54362.exe
        9⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
        10⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe
        9⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        9⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54262.exe
        8⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31726.exe
        8⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        8⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6344.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49235.exe
        8⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
        9⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        8⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        8⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43105.exe
        7⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34046.exe
        8⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
        8⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14538.exe
        7⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        7⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20651.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe
        7⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37279.exe
        8⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38213.exe
        9⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
        9⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40713.exe
        8⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58793.exe
        8⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60392.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13868.exe
        7⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
        6⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45255.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36505.exe
        7⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
        6⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe
        6⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39379.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1622.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22126.exe
        7⤵
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        8⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33121.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        8⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
        7⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5824.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45239.exe
        6⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe
        7⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
        7⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49047.exe
        6⤵
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24617.exe
        6⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        6⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33173.exe
        6⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
        6⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        5⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8778.exe
        6⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27144.exe
        7⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        8⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28145.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56858.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        7⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
        6⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21392.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
        6⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46911.exe
        5⤵
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62338.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24377.exe
        6⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41881.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53209.exe
        5⤵
        
        PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35843.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13996.exe
        5⤵
        
        PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39296.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-506.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50631.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        7⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        8⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
        8⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1657.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        7⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe
        6⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        7⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        6⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38933.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22894.exe
        6⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe
        7⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34559.exe
        7⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10999.exe
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23598.exe
        6⤵
        
        PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        5⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe
        6⤵
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        6⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62888.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22744.exe
        5⤵
        
        PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe
        6⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31228.exe
        7⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20485.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        7⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22244.exe
        6⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2126.exe
        7⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3494.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        6⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12758.exe
        5⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe
        6⤵
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        6⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44771.exe
        5⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8280.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64335.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39038.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
        6⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17985.exe
        7⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        7⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        6⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49079.exe
        5⤵
        
        PID:1004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        5⤵
        
        PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe
      4⤵
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21306.exe
        5⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52987.exe
        6⤵
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        6⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24377.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        5⤵
        
        PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53785.exe
      4⤵
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        5⤵
        
        PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37789.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe
      4⤵
      PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-319.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5877.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-506.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16458.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19360.exe
        7⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
        8⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24377.exe
        7⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        7⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32279.exe
        6⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64398.exe
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        6⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52639.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18592.exe
        6⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23071.exe
        7⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47237.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        6⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33457.exe
        5⤵
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1840.exe
        6⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        6⤵
        
        PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44087.exe
        5⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34996.exe
        5⤵
        
        PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47424.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe
        6⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        7⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50356.exe
        8⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11508.exe
        8⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4149.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41881.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29042.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12430.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        6⤵
        
        PID:336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        5⤵
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25006.exe
        6⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15545.exe
        7⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14034.exe
        7⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
        6⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60506.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34996.exe
        5⤵
        
        PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19311.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29199.exe
        5⤵
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45530.exe
        6⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42406.exe
        7⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
        7⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38876.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        5⤵
        
        PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61606.exe
      4⤵
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62961.exe
        5⤵
        
        PID:548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        5⤵
        
        PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1322.exe
      4⤵
      PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64953.exe
      4⤵
      PID:4864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61767.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58799.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe
        6⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8778.exe
        7⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54362.exe
        8⤵
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe
        8⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        8⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        7⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12146.exe
        8⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
        8⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        7⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
        7⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        6⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34238.exe
        7⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
        7⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12935.exe
        6⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2452.exe
        5⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49147.exe
        6⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20258.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        6⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38741.exe
        5⤵
        
        PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54777.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49235.exe
        5⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44798.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        6⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        5⤵
        
        PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20546.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54274.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58872.exe
        5⤵
        
        PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49349.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
      4⤵
      PID:2324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22608.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6967.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1212.exe
        5⤵
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34046.exe
        6⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        6⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5161.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28145.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48227.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27039.exe
      4⤵
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17990.exe
        5⤵
        
        PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4553.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34106.exe
        5⤵
        
        PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47210.exe
      4⤵
      PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1959.exe
      4⤵
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41016.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62722.exe
      4⤵
      PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57626.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
      4⤵
      PID:5392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7106.exe
    3⤵
    PID:1596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15614.exe
    3⤵
    PID:3204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13996.exe
    3⤵
    PID:5156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20185.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16755.exe
        7⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe
        8⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        8⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        7⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        7⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
        6⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42214.exe
        7⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        7⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
        6⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        6⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48908.exe
        6⤵
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64232.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        6⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30873.exe
        5⤵
        
        PID:352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        5⤵
        
        PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39081.exe
        5⤵
        
        PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58238.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3075.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24377.exe
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        6⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42472.exe
        5⤵
        
        PID:1020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        6⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38113.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
        5⤵
        
        PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-837.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56355.exe
        5⤵
        
        PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25243.exe
        5⤵
        
        PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12234.exe
      4⤵
      PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3216.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18461.exe
      4⤵
      PID:5204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5062.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47377.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49235.exe
        6⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exe
        7⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        7⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        6⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe
        5⤵
        
        PID:648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12281.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        6⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
        5⤵
        
        PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36110.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3407.exe
        5⤵
        
        PID:892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45374.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3307.exe
      4⤵
      PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1383.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34996.exe
      4⤵
      PID:5268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38270.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
        5⤵
        
        PID:1344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        6⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60584.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
        5⤵
        
        PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3028.exe
      4⤵
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe
        5⤵
        
        PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        5⤵
        
        PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10536.exe
      4⤵
      PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29464.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61715.exe
      4⤵
      PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10418.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
      4⤵
      PID:5672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24435.exe
    3⤵
    PID:1928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48242.exe
    3⤵
    PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35527.exe
    3⤵
    PID:5196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45239.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5405.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe
        6⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22815.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        6⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12706.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47746.exe
        5⤵
        
        PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36686.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7154.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25243.exe
        5⤵
        
        PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42633.exe
      4⤵
      PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15280.exe
      4⤵
      PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
      4⤵
      PID:5884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25373.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6967.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57616.exe
        5⤵
        
        PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58171.exe
      4⤵
      PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10418.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56167.exe
      4⤵
      PID:5744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43816.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
      4⤵
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7154.exe
        5⤵
        
        PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25243.exe
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57486.exe
      4⤵
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
        5⤵
        
        PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
      4⤵
      PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
      4⤵
      PID:5788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61030.exe
    3⤵
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1098.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28145.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe
    3⤵
    PID:3740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57356.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24663.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24663.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45239.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25006.exe
        5⤵
        
        PID:1224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
        5⤵
        
        PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38580.exe
      4⤵
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11529.exe
        5⤵
        
        PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23914.exe
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
      4⤵
      PID:4756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18404.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18404.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59650.exe
      4⤵
      PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25898.exe
        5⤵
        
        PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62146.exe
      4⤵
      PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
      4⤵
      PID:4556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9472.exe
    3⤵
    PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe
      4⤵
      PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9415.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58565.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58565.exe
    3⤵
    PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
      4⤵
      PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28145.exe
      4⤵
      PID:956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45427.exe
    3⤵
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe
    3⤵
    PID:2472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38270.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60719.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        5⤵
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34046.exe
        6⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        6⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        5⤵
        
        PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28191.exe
      4⤵
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26262.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62956.exe
        5⤵
        
        PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
      4⤵
      PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
      4⤵
      PID:5220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41429.exe
    3⤵
    PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54274.exe
      4⤵
      PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
      4⤵
      PID:5212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13442.exe
    3⤵
    PID:3748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
    3⤵
    PID:5124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25056.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25056.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38929.exe
    3⤵
    PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34367.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13905.exe
    3⤵
    PID:3840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
    3⤵
    PID:5008
- C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
  2⤵
  PID:2284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61715.exe
    3⤵
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
    3⤵
    PID:4524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
  2⤵
  PID:1612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15545.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11508.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11508.exe
    3⤵
    PID:5844
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57793.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57793.exe
  2⤵
  PID:3240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28483.exe
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
    3⤵
    PID:5228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63338.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63338.exe
  2⤵
  PID:4424
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38109.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38109.exe
  2⤵
  PID:5864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe

Filesize
468KB

MD5
1c03d9ba57a376503f385bdb8361e049

SHA1
e1e4c2bf2ec85e4ce9420d419212a0b44c2b206b

SHA256
aac55c4739e19249cc92f6034cd133d57716529b3172375b8274eed262fd7dff

SHA512
c5aaf215aa74a998313946a135172edf5b255bf0887943c7bd0d637c9ec8c7bd9dc3c5f1fdff42af1e0e940841e15858a31e6765bfd5bcdce184718eadb8190d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-319.exe

Filesize
468KB

MD5
1de0c2760714b182b54bedc358b0968a

SHA1
54be34f828eaa62cd0df005c797ebe4d7149aaec

SHA256
a360a4f4b39f15cd6edbcf343ea07c908afd14656f0793aa4bbdb54043e91dc4

SHA512
ac87fb562a1939ee54dd9b2eea943c97e54e1fa8378eadfeecc6512061c80abffe0c1700e25cc107768e29f640c92ae63deade13bee8e69e48c4d2119f231365

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39296.exe

Filesize
468KB

MD5
af4f32a2f9a697cb8ce5fb6dc07e03e9

SHA1
d249ac47ea8249e565336a2f75c91108fe39d592

SHA256
7946254674e5ecd630ecfc2600f7e88f9b71ccdb8430fc29e86eaa7b6f1d6629

SHA512
18ed31ad38c45ac1ee0b6181d2764cb3e61b7a93f45e6f2a3580e584eeef713e712f935c1960be9c7e43fb1175f39bcfcaf32b5a9abec3583ad62052f6d7a0ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe

Filesize
468KB

MD5
3075efc3d056b6f5cdf50d3bc3e5f7ea

SHA1
2519601c4bcc15907829bbd84f32d02b5d1ef28c

SHA256
1554ed1d8d395c8cb9399ddf9060a2fbb63e9e57e808d1d47d4cce5f9019d4cf

SHA512
3e998a255f719f5686c65d42dc2eaff5422c1e8f0b9c437555ead155efaac42c21c43cfb972f383f2b255704c4cbfdbecc32330cc4651544f5415ea2b57e49e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe

Filesize
468KB

MD5
49f8a2d977032dc15cb702951df68016

SHA1
1f01b515ceff992acd9c1b972bbf49657ec2209b

SHA256
953b4c0e9460ccf5749283be5a835653d16d8a703b9da523011734799ce91245

SHA512
5df4b2d8e33f9391840124d61806ef71595b596d84d3ac014c1c0195bb251b391a5f0158157bb90ae690d5714436ef4b16a48d3a7beb8d7747182eee4d2c5db8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exe

Filesize
468KB

MD5
24b2de3a1f5154d900195002cfdd1a48

SHA1
af22780950d31571cf5f238c96d732a3a6be804b

SHA256
1061bcaedec528005d2ab9a083bf85fd5a0e3227f432b30dc5ee209043780b25

SHA512
1bd620fdaa157740e233f23cced573b992d0bac28d90b1a19abba361a95d3e1ac98cfd358c1a0f97f74575e88330b5d9c6fa7ab6a8a5a2d45e8d54c1dbebfe3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe

Filesize
468KB

MD5
9a34e5f78e91a444d97c1648478e43e0

SHA1
768908860299616ecd6c5a04920757fa433a4442

SHA256
dee47010ddc8931da3be71acc062c58bfc4d80780420e285806b0d87b0bf8982

SHA512
94bc83038aec3fc1339cc046fea88cec4b29832d15b635660814d019ced0a7da1e74895f9d4ae38f3e32b44b69d60693e6f668e8de5f468019c52af55a3ff285

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe

Filesize
468KB

MD5
c718cdfa37f93da0d7b0c705df6768d7

SHA1
e64e5b78338fad894ff24c57ee19eb63ef3fa067

SHA256
f0ecececfe666a59220b26ffb37363661f44450bbe4efb8e5c74dc635164fec0

SHA512
5f85b62f8589bc04d74ac01c9903d20aa79ddcdd0a2ae37d7d270f7a96641fa20b3e4e04606b899103f1c0bda12351a763924365a09683c43194518197216dd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63163.exe

Filesize
468KB

MD5
91ad311581423ace49d0eab47b3d5dcf

SHA1
b657709cd68a4c10e39954dcb8e0d4205ba09b29

SHA256
1ac59c2918afa6b422ed83d4ae4d8d7e9158f9abb09d4341b0e50d80b6e4042e

SHA512
d7f544145683393c258821c2685514436e85b4713a8ce233bb458153c6be9af557c07ccbe5e8b00f1707012a36a8c10ff09a327b61e89721961ec556a38e1826

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1793.exe

Filesize
468KB

MD5
01d672bffc8ea419dc1f1b6edbcdf846

SHA1
6a8d47d4314f8e1e61d24ac24f0d4496ac96f772

SHA256
f28f1e938c18847789890c811c08ec52d0980505b33abe0a3ffd1cf2f03ee166

SHA512
9a6e79f055bf11807545abc1e18797acb51f11ed12629d15fb6f49f326f0a311d66553c0073baaf7914f720e5b4eb68c60f9ae3956f3dfb77014e979d3fa6ade

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20185.exe

Filesize
468KB

MD5
84c5e4fb3c3fdfd3fbce7ed62aec0c94

SHA1
04524ebe0f137f9232ee8ad53852f558d1925b0f

SHA256
9382332f0b4204f2d7876cbb9a680579c07d3ec20edc4b9e4ef6faf77db311f1

SHA512
9942b94e2a9f6ce7f62cc6cf08d9699964ee7845700cc53b9fa814135885483a9c77c8be4704913c2862c7f5e410a6224135692a9caf6dd66a62a4e5925b8a5a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24663.exe

Filesize
468KB

MD5
a775c6f46d8f2f5ab567112b878c7c3f

SHA1
db9f75648b90af21a6db35b6c007dcfba1326108

SHA256
3a4e6066aac69b83572ef97963f80a84457c85d0fc152c9b854fe5eff012f23e

SHA512
649136b3d2ff6110908691576a94710ece06ead22284b05da7d3c0a431b426fa80275ab37134ee6035c88562478c7eb7f1fe0e195f2c4492937bdac677013672

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe

Filesize
468KB

MD5
0ae4c4e4a4a6568f818987966f38ee5a

SHA1
1c726b39b7125d8ff8806ed2dc38c345dd4f3196

SHA256
45f9dd6e38fcea99e61efc86f56b06704c32264bd0304addcdabc6ed6a5c86b7

SHA512
8e2eb27a5de9acfc4d3e448366cf8e03c3daa9407a53b060af66f4b1363effb0914577cb9651cdbe212a2d018c0f7b63e5f3f2bb8dd0941c4750af560390cf81

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe

Filesize
468KB

MD5
5d7d988e6c74766fb8240ce78b42587b

SHA1
072c3289c3c37f24a6e12f356a775ed5bb5d94d5

SHA256
94948388544c3aeba7bed647f1d584132ad59d98dc5d28aa7a47c0f29612053c

SHA512
051930fdba14024afce519f951eaa960c74c216985d40d11fb87526f6182b6ef6111ab22a1be26f5be4a6b18c3202f6a1368b654c9961eae67baa144fa398a32

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37507.exe

Filesize
468KB

MD5
edddbe6c0b1d58679cc1b05960101b8c

SHA1
5f055c610dc083d56fd8421a3d19febfc4a241b4

SHA256
31555adace1a2efe2c0bb6d4b7b274ad7bb4d91716dcd3bfa2f34effc61b8f95

SHA512
6d028fef9373672c4130ac4881f80e85e8398477b03edc0795dc139c8654efbcba41d31b0640a8ab506a74d442ae9f6c6838d8154e47f42319319b2d71248f99

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39379.exe

Filesize
468KB

MD5
4c80f8cd4e53d38901b27f45ce6ab6e7

SHA1
856af10087a18223249a576c216215036d8b1c18

SHA256
342d9e3f79d56493ff83d294f5340f866cf67bd17098cc0a259b2d654694e7bc

SHA512
5efac95bfdce144c57c9d3c4d89c2c3dab6e225529291b2649a9f4db6c47d201aef3580ee86980ba7e510cd3fb36ad55db5d6310a8eb121ab0cfb7802ed57a49

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-506.exe

Filesize
468KB

MD5
f5fd876023b531579f3ba79ce5ce5002

SHA1
ae3daf4f2e42629459469bdbb796320c36cbc4ca

SHA256
56b5264025eb94b53fbdf83e676448178fbeec988c62f82ac9b55775dcb8f38f

SHA512
02c3ed7465c4b616a2e9764155db46b8a8f4481d97834b24403e86e5a467714980529027f76362d2af02ee9135a1709fd02a1d8cf0f84ce07ab64e816141b187

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5062.exe

Filesize
468KB

MD5
7438166ec8d1748b3d1703efd9ed6317

SHA1
360960397a298870044298384ccf14b767a49f3b

SHA256
773ac158a80ccb31317b70a2730271af7b5b3fb6d183c2951b591844d379f4ad

SHA512
3e88f8439fb90bab9e92c07c169358246fb5d9c93fc9d94af6e6f92f1ac04d19c7e3ad84d739b09bb241abd08289ea58d7a1fb47b36c4263bd941c725355022c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe

Filesize
468KB

MD5
4c46c4d756e5dc5f1cd72cd5dfa800fa

SHA1
cc3e487c07fdd66126bb5930aa329951fb009037

SHA256
e9a543c47c35d04b4d125a956815d4f9152a8f086a7058365a34d37efa0fa459

SHA512
5b9acb4c0d899f960dc23c6c4942f3984c1e1938d22e35928f097a7356ab1e41078910e13f45192155697870c1ccfd2e86ed1759774c199821ab06cf06570148

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5877.exe

Filesize
468KB

MD5
2c65c2d609791fece5d9743c121d60b6

SHA1
6c942a37332d2eb8c34d6bf91bcacd93e3086a1c

SHA256
f8db06b03ed5477acc1b1bbe21bbbe73cce0d8e4a58691a96f920322a45c3fce

SHA512
ef8002ff42fa57b0e9e6c68d36cc4ea2d673ac0c6d6213700888413a7ef1310ffcfcf8ceb480582a3fb1b89dd160a483719b9d8565a92eb4e304e6fefad34342

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe

Filesize
468KB

MD5
2c5ae030b8fc2044c7a406bade6d7452

SHA1
17ea9802ec3b84d87d50ab010f06102bc6f0a968

SHA256
e974ecaf7e3f8ecc68b17e0e9a61142edea47ef8c9728b9e2636a4c0f09939f5

SHA512
e477b06d056fa237fa935cbf46c8fc8d207c51f5a2cc4b8c11dd1a94da06277ace362355dc3e03c24b37cdbac374436897bb2ae210b1e0a4665e55868b7bee62

Download Submit
memory/264-258-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/264-257-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/264-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1324-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1324-382-0x0000000001EA0000-0x0000000001F15000-memory.dmp

Filesize
468KB

Download
memory/1324-383-0x0000000001EA0000-0x0000000001F15000-memory.dmp

Filesize
468KB

Download
memory/1572-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1608-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1716-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1740-399-0x00000000027A0000-0x0000000002815000-memory.dmp

Filesize
468KB

Download
memory/1740-228-0x00000000027A0000-0x0000000002815000-memory.dmp

Filesize
468KB

Download
memory/1740-227-0x00000000027A0000-0x0000000002815000-memory.dmp

Filesize
468KB

Download
memory/1740-47-0x00000000027A0000-0x0000000002815000-memory.dmp

Filesize
468KB

Download
memory/1740-397-0x00000000027A0000-0x0000000002815000-memory.dmp

Filesize
468KB

Download
memory/1812-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2008-306-0x00000000033E0000-0x0000000003455000-memory.dmp

Filesize
468KB

Download
memory/2008-319-0x00000000033E0000-0x0000000003455000-memory.dmp

Filesize
468KB

Download
memory/2024-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2024-398-0x0000000001E30000-0x0000000001EA5000-memory.dmp

Filesize
468KB

Download
memory/2024-402-0x0000000001E30000-0x0000000001EA5000-memory.dmp

Filesize
468KB

Download
memory/2068-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-347-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2160-346-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2160-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2180-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2228-209-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2228-366-0x0000000001E70000-0x0000000001EE5000-memory.dmp

Filesize
468KB

Download
memory/2228-367-0x0000000001E70000-0x0000000001EE5000-memory.dmp

Filesize
468KB

Download
memory/2248-416-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2248-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2344-230-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2344-415-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2344-226-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2344-417-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2344-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-154-0x0000000002970000-0x00000000029E5000-memory.dmp

Filesize
468KB

Download
memory/2348-316-0x00000000034A0000-0x0000000003515000-memory.dmp

Filesize
468KB

Download
memory/2348-305-0x00000000034A0000-0x0000000003515000-memory.dmp

Filesize
468KB

Download
memory/2348-165-0x0000000002970000-0x00000000029E5000-memory.dmp

Filesize
468KB

Download
memory/2348-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-176-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/2376-321-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/2376-318-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/2376-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-148-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/2376-10-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/2400-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-136-0x0000000003480000-0x00000000034F5000-memory.dmp

Filesize
468KB

Download
memory/2552-67-0x0000000002790000-0x0000000002805000-memory.dmp

Filesize
468KB

Download
memory/2552-288-0x0000000002790000-0x0000000002805000-memory.dmp

Filesize
468KB

Download
memory/2552-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-285-0x0000000002790000-0x0000000002805000-memory.dmp

Filesize
468KB

Download
memory/2552-24-0x0000000003480000-0x00000000034F5000-memory.dmp

Filesize
468KB

Download
memory/2616-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2620-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2656-138-0x0000000002720000-0x0000000002795000-memory.dmp

Filesize
468KB

Download
memory/2656-137-0x0000000002720000-0x0000000002795000-memory.dmp

Filesize
468KB

Download
memory/2656-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2656-320-0x0000000002720000-0x0000000002795000-memory.dmp

Filesize
468KB

Download
memory/2656-323-0x0000000002720000-0x0000000002795000-memory.dmp

Filesize
468KB

Download
memory/2668-309-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2668-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2668-324-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2700-235-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2700-232-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2748-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2764-113-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2764-246-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2764-245-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2764-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2840-381-0x0000000002010000-0x0000000002085000-memory.dmp

Filesize
468KB

Download
memory/2840-48-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2840-207-0x0000000002010000-0x0000000002085000-memory.dmp

Filesize
468KB

Download
memory/2840-205-0x0000000002010000-0x0000000002085000-memory.dmp

Filesize
468KB

Download
memory/2840-90-0x0000000002010000-0x0000000002085000-memory.dmp

Filesize
468KB

Download
memory/2852-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-155-0x00000000027F0000-0x0000000002865000-memory.dmp

Filesize
468KB

Download
memory/2872-292-0x00000000027F0000-0x0000000002865000-memory.dmp

Filesize
468KB

Download
memory/2872-174-0x00000000027F0000-0x0000000002865000-memory.dmp

Filesize
468KB

Download
memory/2872-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-284-0x00000000027F0000-0x0000000002865000-memory.dmp

Filesize
468KB

Download
memory/2896-289-0x00000000023E0000-0x0000000002455000-memory.dmp

Filesize
468KB

Download
memory/2896-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-294-0x0000000002C80000-0x0000000002CF5000-memory.dmp

Filesize
468KB

Download
memory/2904-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-293-0x0000000002C80000-0x0000000002CF5000-memory.dmp

Filesize
468KB

Download
memory/3016-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-195-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3068-363-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3068-364-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3068-194-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download