78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee

Analysis

max time kernel
147s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe
Size

468KB
MD5

e42b7593dedd49278ac32958ed49274d
SHA1

10a493912a77396d6c5882742c9a134fd6555126
SHA256

78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee
SHA512

1c7ae056820f698fbe287c117daa6d940b4d33c614fdeffa3c050538db419e2828e25fe992d6721e4fa8936f5cc67d5415fa0ad6a952c1218ae73031bfbf1e4d
SSDEEP

3072:pq0RogFdjY8U2bxAPz7iff5kChgNXpfkmHebVpfn9ZCQ3Xhatt5lL:pqyoq1U2OPviffc5WD9ZCuRatt

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2388	Unicorn-11932.exe
2824	Unicorn-28051.exe
2724	Unicorn-38911.exe
2844	Unicorn-23858.exe
2636	Unicorn-1775.exe
2752	Unicorn-7905.exe
3056	Unicorn-53577.exe
2944	Unicorn-65513.exe
3044	Unicorn-38606.exe
2432	Unicorn-10474.exe
1040	Unicorn-45185.exe
1860	Unicorn-62176.exe
2624	Unicorn-31449.exe
1956	Unicorn-51315.exe
1520	Unicorn-51315.exe
1632	Unicorn-29032.exe
304	Unicorn-30101.exe
3012	Unicorn-9166.exe
3028	Unicorn-58996.exe
1948	Unicorn-49736.exe
2348	Unicorn-1190.exe
1560	Unicorn-55866.exe
1712	Unicorn-21056.exe
872	Unicorn-36000.exe
1292	Unicorn-55601.exe
2992	Unicorn-7433.exe
1616	Unicorn-41044.exe
880	Unicorn-60910.exe
2300	Unicorn-54780.exe
2268	Unicorn-58772.exe
2988	Unicorn-57957.exe
2740	Unicorn-48850.exe
2972	Unicorn-48850.exe
2608	Unicorn-24245.exe
3068	Unicorn-14786.exe
2384	Unicorn-14786.exe
2716	Unicorn-25991.exe
2640	Unicorn-30182.exe
2544	Unicorn-45404.exe
1864	Unicorn-16645.exe
2520	Unicorn-7661.exe
612	Unicorn-45809.exe
2328	Unicorn-56478.exe
2676	Unicorn-56478.exe
2904	Unicorn-49364.exe
2136	Unicorn-35336.exe
844	Unicorn-39442.exe
1288	Unicorn-51694.exe
2548	Unicorn-41942.exe
1008	Unicorn-447.exe
2408	Unicorn-53640.exe
1684	Unicorn-11792.exe
636	Unicorn-60338.exe
2332	Unicorn-21352.exe
1312	Unicorn-64522.exe
2296	Unicorn-60438.exe
3064	Unicorn-49178.exe
272	Unicorn-62192.exe
2796	Unicorn-52554.exe
2600	Unicorn-58419.exe
2652	Unicorn-13302.exe
2104	Unicorn-46432.exe
984	Unicorn-20152.exe
2460	Unicorn-17460.exe

Loads dropped DLL 64 IoCs

pid	Process
2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe
2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe
2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe
2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe
2388	Unicorn-11932.exe
2388	Unicorn-11932.exe
2824	Unicorn-28051.exe
2824	Unicorn-28051.exe
2724	Unicorn-38911.exe
2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe
2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe
2724	Unicorn-38911.exe
2388	Unicorn-11932.exe
2388	Unicorn-11932.exe
2636	Unicorn-1775.exe
2636	Unicorn-1775.exe
2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe
2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe
2844	Unicorn-23858.exe
2844	Unicorn-23858.exe
2388	Unicorn-11932.exe
2824	Unicorn-28051.exe
2388	Unicorn-11932.exe
2824	Unicorn-28051.exe
2724	Unicorn-38911.exe
2724	Unicorn-38911.exe
2752	Unicorn-7905.exe
3056	Unicorn-53577.exe
3056	Unicorn-53577.exe
2752	Unicorn-7905.exe
2944	Unicorn-65513.exe
2944	Unicorn-65513.exe
3044	Unicorn-38606.exe
3044	Unicorn-38606.exe
2636	Unicorn-1775.exe
2636	Unicorn-1775.exe
2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe
2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe
2724	Unicorn-38911.exe
2724	Unicorn-38911.exe
1956	Unicorn-51315.exe
3056	Unicorn-53577.exe
2388	Unicorn-11932.exe
1860	Unicorn-62176.exe
2844	Unicorn-23858.exe
1956	Unicorn-51315.exe
3056	Unicorn-53577.exe
2844	Unicorn-23858.exe
2388	Unicorn-11932.exe
1860	Unicorn-62176.exe
2624	Unicorn-31449.exe
2624	Unicorn-31449.exe
2752	Unicorn-7905.exe
2752	Unicorn-7905.exe
2824	Unicorn-28051.exe
1520	Unicorn-51315.exe
1520	Unicorn-51315.exe
2824	Unicorn-28051.exe
1632	Unicorn-29032.exe
1632	Unicorn-29032.exe
3044	Unicorn-38606.exe
3044	Unicorn-38606.exe
3012	Unicorn-9166.exe
3028	Unicorn-58996.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22747.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe
2388	Unicorn-11932.exe
2824	Unicorn-28051.exe
2724	Unicorn-38911.exe
2844	Unicorn-23858.exe
2636	Unicorn-1775.exe
2752	Unicorn-7905.exe
3056	Unicorn-53577.exe
2944	Unicorn-65513.exe
3044	Unicorn-38606.exe
2432	Unicorn-10474.exe
1860	Unicorn-62176.exe
1040	Unicorn-45185.exe
1956	Unicorn-51315.exe
1520	Unicorn-51315.exe
2624	Unicorn-31449.exe
1632	Unicorn-29032.exe
3012	Unicorn-9166.exe
304	Unicorn-30101.exe
3028	Unicorn-58996.exe
1948	Unicorn-49736.exe
1616	Unicorn-41044.exe
1292	Unicorn-55601.exe
872	Unicorn-36000.exe
1712	Unicorn-21056.exe
1560	Unicorn-55866.exe
2348	Unicorn-1190.exe
880	Unicorn-60910.exe
2992	Unicorn-7433.exe
2268	Unicorn-58772.exe
2300	Unicorn-54780.exe
2972	Unicorn-48850.exe
2988	Unicorn-57957.exe
2740	Unicorn-48850.exe
2384	Unicorn-14786.exe
2716	Unicorn-25991.exe
2640	Unicorn-30182.exe
2608	Unicorn-24245.exe
3068	Unicorn-14786.exe
2544	Unicorn-45404.exe
1864	Unicorn-16645.exe
612	Unicorn-45809.exe
2520	Unicorn-7661.exe
2676	Unicorn-56478.exe
2328	Unicorn-56478.exe
2904	Unicorn-49364.exe
2136	Unicorn-35336.exe
844	Unicorn-39442.exe
1288	Unicorn-51694.exe
2548	Unicorn-41942.exe
2408	Unicorn-53640.exe
1684	Unicorn-11792.exe
1008	Unicorn-447.exe
636	Unicorn-60338.exe
2296	Unicorn-60438.exe
2332	Unicorn-21352.exe
1312	Unicorn-64522.exe
272	Unicorn-62192.exe
3064	Unicorn-49178.exe
2796	Unicorn-52554.exe
2600	Unicorn-58419.exe
2652	Unicorn-13302.exe
2104	Unicorn-46432.exe
984	Unicorn-20152.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2388	2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe	29
PID 2256 wrote to memory of 2388	2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe	29
PID 2256 wrote to memory of 2388	2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe	29
PID 2256 wrote to memory of 2388	2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe	29
PID 2256 wrote to memory of 2724	2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe	30
PID 2256 wrote to memory of 2724	2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe	30
PID 2256 wrote to memory of 2724	2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe	30
PID 2256 wrote to memory of 2724	2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe	30
PID 2388 wrote to memory of 2824	2388	Unicorn-11932.exe	31
PID 2388 wrote to memory of 2824	2388	Unicorn-11932.exe	31
PID 2388 wrote to memory of 2824	2388	Unicorn-11932.exe	31
PID 2388 wrote to memory of 2824	2388	Unicorn-11932.exe	31
PID 2824 wrote to memory of 2844	2824	Unicorn-28051.exe	32
PID 2824 wrote to memory of 2844	2824	Unicorn-28051.exe	32
PID 2824 wrote to memory of 2844	2824	Unicorn-28051.exe	32
PID 2824 wrote to memory of 2844	2824	Unicorn-28051.exe	32
PID 2256 wrote to memory of 2636	2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe	34
PID 2256 wrote to memory of 2636	2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe	34
PID 2256 wrote to memory of 2636	2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe	34
PID 2256 wrote to memory of 2636	2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe	34
PID 2724 wrote to memory of 2752	2724	Unicorn-38911.exe	33
PID 2724 wrote to memory of 2752	2724	Unicorn-38911.exe	33
PID 2724 wrote to memory of 2752	2724	Unicorn-38911.exe	33
PID 2724 wrote to memory of 2752	2724	Unicorn-38911.exe	33
PID 2388 wrote to memory of 3056	2388	Unicorn-11932.exe	35
PID 2388 wrote to memory of 3056	2388	Unicorn-11932.exe	35
PID 2388 wrote to memory of 3056	2388	Unicorn-11932.exe	35
PID 2388 wrote to memory of 3056	2388	Unicorn-11932.exe	35
PID 2636 wrote to memory of 2944	2636	Unicorn-1775.exe	36
PID 2636 wrote to memory of 2944	2636	Unicorn-1775.exe	36
PID 2636 wrote to memory of 2944	2636	Unicorn-1775.exe	36
PID 2636 wrote to memory of 2944	2636	Unicorn-1775.exe	36
PID 2256 wrote to memory of 3044	2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe	37
PID 2256 wrote to memory of 3044	2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe	37
PID 2256 wrote to memory of 3044	2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe	37
PID 2256 wrote to memory of 3044	2256	78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe	37
PID 2844 wrote to memory of 2432	2844	Unicorn-23858.exe	38
PID 2844 wrote to memory of 2432	2844	Unicorn-23858.exe	38
PID 2844 wrote to memory of 2432	2844	Unicorn-23858.exe	38
PID 2844 wrote to memory of 2432	2844	Unicorn-23858.exe	38
PID 2388 wrote to memory of 1040	2388	Unicorn-11932.exe	39
PID 2388 wrote to memory of 1040	2388	Unicorn-11932.exe	39
PID 2388 wrote to memory of 1040	2388	Unicorn-11932.exe	39
PID 2388 wrote to memory of 1040	2388	Unicorn-11932.exe	39
PID 2824 wrote to memory of 2624	2824	Unicorn-28051.exe	40
PID 2824 wrote to memory of 2624	2824	Unicorn-28051.exe	40
PID 2824 wrote to memory of 2624	2824	Unicorn-28051.exe	40
PID 2824 wrote to memory of 2624	2824	Unicorn-28051.exe	40
PID 2724 wrote to memory of 1860	2724	Unicorn-38911.exe	41
PID 2724 wrote to memory of 1860	2724	Unicorn-38911.exe	41
PID 2724 wrote to memory of 1860	2724	Unicorn-38911.exe	41
PID 2724 wrote to memory of 1860	2724	Unicorn-38911.exe	41
PID 3056 wrote to memory of 1956	3056	Unicorn-53577.exe	43
PID 3056 wrote to memory of 1956	3056	Unicorn-53577.exe	43
PID 3056 wrote to memory of 1956	3056	Unicorn-53577.exe	43
PID 3056 wrote to memory of 1956	3056	Unicorn-53577.exe	43
PID 2752 wrote to memory of 1520	2752	Unicorn-7905.exe	42
PID 2752 wrote to memory of 1520	2752	Unicorn-7905.exe	42
PID 2752 wrote to memory of 1520	2752	Unicorn-7905.exe	42
PID 2752 wrote to memory of 1520	2752	Unicorn-7905.exe	42
PID 2944 wrote to memory of 304	2944	Unicorn-65513.exe	44
PID 2944 wrote to memory of 304	2944	Unicorn-65513.exe	44
PID 2944 wrote to memory of 304	2944	Unicorn-65513.exe	44
PID 2944 wrote to memory of 304	2944	Unicorn-65513.exe	44

C:\Users\Admin\AppData\Local\Temp\78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe
"C:\Users\Admin\AppData\Local\Temp\78e7151b53bac1fb9292af1703a22e9dac2d2a5e3851beb3ed3b84c64ae347ee.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28051.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28051.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10474.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56354.exe
        7⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
        7⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        7⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        7⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        7⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26619.exe
        7⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62668.exe
        6⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8988.exe
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24141.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50792.exe
        6⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63883.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13396.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43442.exe
        6⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36000.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17460.exe
        6⤵
        Executes dropped EXE
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47667.exe
        7⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11159.exe
        7⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6184.exe
        7⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7868.exe
        7⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21125.exe
        7⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46276.exe
        6⤵
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        6⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12049.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56870.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38191.exe
        6⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11735.exe
        5⤵
        
        PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28658.exe
        5⤵
        
        PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31449.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11128.exe
        7⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48928.exe
        8⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44289.exe
        9⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60643.exe
        9⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35728.exe
        9⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55184.exe
        9⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16685.exe
        9⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        8⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44316.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4148.exe
        8⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27500.exe
        7⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62913.exe
        7⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61516.exe
        7⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27269.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
        7⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34817.exe
        6⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37064.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63353.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10562.exe
        6⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56478.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55259.exe
        6⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33360.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16862.exe
        7⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7868.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29961.exe
        7⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61133.exe
        6⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        6⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27269.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23546.exe
        6⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55351.exe
        5⤵
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64278.exe
        6⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58990.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28742.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64547.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-150.exe
        6⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4698.exe
        5⤵
        
        PID:960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31881.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52404.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11325.exe
        5⤵
        
        PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54780.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1699.exe
        5⤵
        
        PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
        5⤵
        
        PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26619.exe
        5⤵
        
        PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1434.exe
      4⤵
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        5⤵
        
        PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33796.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6226.exe
      4⤵
      PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39680.exe
      4⤵
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22804.exe
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62218.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51315.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21056.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
        7⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41593.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22516.exe
        7⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20484.exe
        6⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36554.exe
        6⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        6⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35336.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18036.exe
        6⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
        6⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
        6⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22019.exe
        5⤵
        
        PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42462.exe
        5⤵
        
        PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        5⤵
        
        PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62861.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43795.exe
        5⤵
        
        PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
        5⤵
        
        PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51694.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12638.exe
        6⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20946.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65499.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13627.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18385.exe
        6⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
        5⤵
        
        PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5827.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60321.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47615.exe
        5⤵
        
        PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-447.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6383.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9595.exe
        5⤵
        
        PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57682.exe
      4⤵
      PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37719.exe
      4⤵
      PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54332.exe
      4⤵
      PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
      4⤵
      PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11315.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43883.exe
      4⤵
      PID:6004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45185.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64522.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
        6⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        7⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58990.exe
        7⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2100.exe
        7⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23896.exe
        7⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23354.exe
        7⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51237.exe
        6⤵
        
        PID:360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34608.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63353.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26457.exe
        5⤵
        
        PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36955.exe
        5⤵
        
        PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63353.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        5⤵
        
        PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52554.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33634.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23555.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50347.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34875.exe
        5⤵
        
        PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-853.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
      4⤵
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47118.exe
      4⤵
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28658.exe
      4⤵
      PID:4852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55601.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
      4⤵
      PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19832.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19610.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe
      4⤵
      PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
      4⤵
      PID:3820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49178.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64470.exe
      4⤵
      PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20946.exe
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30688.exe
      4⤵
      PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13627.exe
      4⤵
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32315.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19470.exe
      4⤵
      PID:6096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-494.exe
    3⤵
    PID:2820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32412.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
    3⤵
    PID:3376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37017.exe
    3⤵
    PID:3492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42411.exe
    3⤵
    PID:4344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
    3⤵
    PID:4832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38911.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38911.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7905.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51315.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28150.exe
        6⤵
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41593.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe
        6⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22516.exe
        6⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe
        5⤵
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4688.exe
        6⤵
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24179.exe
        6⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11110.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65512.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17809.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53104.exe
        5⤵
        
        PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8398.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16660.exe
        5⤵
        
        PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41044.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53640.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40483.exe
        6⤵
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36476.exe
        6⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62778.exe
        5⤵
        
        PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28192.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19034.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31168.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60338.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16841.exe
      4⤵
      PID:948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62416.exe
      4⤵
      PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22747.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57209.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55866.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11792.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21542.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15817.exe
        6⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        5⤵
        
        PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61516.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9903.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62265.exe
        5⤵
        
        PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12000.exe
        5⤵
        
        PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11826.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32102.exe
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44939.exe
        5⤵
        
        PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56394.exe
      4⤵
      PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2149.exe
      4⤵
      PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16392.exe
      4⤵
      PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28658.exe
      4⤵
      PID:4900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62192.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61289.exe
        5⤵
        
        PID:592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65046.exe
        6⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20946.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26435.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16394.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
        6⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25445.exe
        5⤵
        
        PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
        5⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55282.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
        5⤵
        
        PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37147.exe
      4⤵
      PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51838.exe
      4⤵
      PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63353.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13201.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39582.exe
      4⤵
      PID:836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13302.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
      4⤵
      PID:888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4618.exe
      4⤵
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
      4⤵
      PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7675.exe
      4⤵
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe
      4⤵
      PID:5144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39251.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6226.exe
    3⤵
    PID:4084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
    3⤵
    PID:3296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22804.exe
    3⤵
    PID:5040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
    3⤵
    PID:5112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1775.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1775.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30101.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25991.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46432.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-111.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10992.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        6⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20152.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44289.exe
        6⤵
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60643.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41950.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52470.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23016.exe
        6⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13846.exe
        5⤵
        
        PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61516.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27269.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
        5⤵
        
        PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45404.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51777.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        5⤵
        
        PID:276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63353.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17861.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
        5⤵
        
        PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19388.exe
      4⤵
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9706.exe
        5⤵
        
        PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23555.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51833.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60321.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
      4⤵
      PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
      4⤵
      PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28658.exe
      4⤵
      PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9166.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48850.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35223.exe
        5⤵
        
        PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24108.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
        5⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        5⤵
        
        PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45892.exe
      4⤵
      PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6804.exe
      4⤵
      PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
      4⤵
      PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63353.exe
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe
      4⤵
      PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39582.exe
      4⤵
      PID:4688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24245.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60438.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56629.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3259.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28069.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7568.exe
        5⤵
        
        PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23555.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47749.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60321.exe
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
        5⤵
        
        PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25087.exe
      4⤵
      PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33939.exe
      4⤵
      PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
      4⤵
      PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63353.exe
      4⤵
      PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4540.exe
      4⤵
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39582.exe
      4⤵
      PID:4836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58419.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57725.exe
    3⤵
    PID:1316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10310.exe
    3⤵
    PID:3960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
    3⤵
    PID:3256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22804.exe
    3⤵
    PID:4980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
    3⤵
    PID:3776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38606.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38606.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29032.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58772.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41665.exe
        6⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33252.exe
        6⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1818.exe
        5⤵
        
        PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57124.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34927.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18051.exe
        5⤵
        
        PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41942.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13946.exe
        5⤵
        
        PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11826.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50549.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40981.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36005.exe
        5⤵
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17198.exe
      4⤵
      PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7276.exe
      4⤵
      PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16091.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65077.exe
      4⤵
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48777.exe
      4⤵
      PID:4648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57957.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57957.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43666.exe
      4⤵
      PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58990.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56419.exe
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3208.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60897.exe
      4⤵
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
      4⤵
      PID:6076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32408.exe
    3⤵
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37174.exe
    3⤵
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
    3⤵
    PID:3156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46817.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46817.exe
    3⤵
    PID:3648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65077.exe
    3⤵
    PID:4304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48777.exe
    3⤵
    PID:4640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58996.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58996.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48850.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45809.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17107.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14457.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13745.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59574.exe
        5⤵
        
        PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
      4⤵
      PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5827.exe
      4⤵
      PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43665.exe
      4⤵
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60321.exe
      4⤵
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37501.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56478.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
      4⤵
      PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17874.exe
      4⤵
      PID:108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18161.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23896.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62976.exe
      4⤵
      PID:5324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59243.exe
    3⤵
    PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42727.exe
      4⤵
      PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11826.exe
      4⤵
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35728.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
      4⤵
      PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19470.exe
      4⤵
      PID:6112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32135.exe
    3⤵
    PID:4364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11315.exe
    3⤵
    PID:5108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
    3⤵
    PID:5968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30182.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30182.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9675.exe
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
    3⤵
    PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
    3⤵
    PID:4048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
    3⤵
    PID:3312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
    3⤵
    PID:5004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
    3⤵
    PID:4264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42308.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42308.exe
  2⤵
  PID:1644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
  2⤵
  PID:696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23836.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23836.exe
  2⤵
  PID:3608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41217.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41217.exe
  2⤵
  PID:3168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50062.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50062.exe
  2⤵
  PID:4476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14150.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14150.exe
  2⤵
  PID:5180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12000.exe

Filesize
468KB

MD5
05d851842865eff725799aec54e9de1d

SHA1
a0349f671041f5ccf8f3db894dcfcc707d2fbf09

SHA256
b5dd9f71f922d2ca584f1e6aa20a6b7b1e9f75f8a43761d0968edff8ef5df02e

SHA512
6866f955ee7d47a0e24525ce03ef836d0c0eba871277f3f622c29de7b5376dea33c8db129e6106b13a89e459e6fffba6bb031f297a08e21d3ee620517c9302ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1775.exe

Filesize
468KB

MD5
04a7c585b8158b178a9695c7700222c7

SHA1
d31096ade8202b843db45a74c2229a699aebdbe9

SHA256
288deac13ddfcf58a07b348f20d2148a5f84c2872a85035760a3e15ecd9cf847

SHA512
ab56c5ee93f388bb73bc7e8c52e4fe65bd610be83a99aba7582a267f365d2eaf35aef793c5351948011ddf2accc33f6a4bc00659c1af0db2512ff02b0bb49cc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29032.exe

Filesize
468KB

MD5
deac4f0a5fe17a2acde8287c02517366

SHA1
4cd795da8192dfb4115cef7723c8166e57513e7c

SHA256
9b5866bffcc895053fadf760f2375a0935f9cc85cde1851c8a69d44208374594

SHA512
439dcc6492171b2bc32b830ebc636bea4239071ecaccff271911e4ae4f6c98df2e9deba1426ab0198b132dc214a207b0a43e0fc7889c31beb13006d21dcb9a32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30101.exe

Filesize
468KB

MD5
56c540ddda31bbe5b863d12d35186052

SHA1
4bdd73f41aea5e53220ee4a4ea71726e81347528

SHA256
7a46faf9220a9fb82a73572d07594c2292dea587a91bf85b45a19da474cb61b7

SHA512
f2f457fc69f82ee3ad58d61796099d8a714d8b865a3c8c4c954b1abc9f3ed2e7b0e9be3d57432cd0ce4eb370ca6045f2fc289ac41353fcdf54896ce0e3866ba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38606.exe

Filesize
468KB

MD5
f210d8ae5151c33b0eb385bb1c1a48a3

SHA1
ae7570d698450cf5437e07a3a9670ddcbad13674

SHA256
91cc64d10508aabacf85753cfeb00640e5b5aae8865dfdaf44a2733c6b57b645

SHA512
ab3cfd197daa6caf3f8062d728b1c94befa6f4d7777e55919c27dea95e66220506f403cf32906cf0a39c01071bb0562b635a6ec85de9370832d24093f72d0980

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51315.exe

Filesize
468KB

MD5
fdadba1438a68b8f8339ad7d3765abd7

SHA1
11a2c4da346b42f87217edcb3d547c67c48abb6e

SHA256
c8f65e6a8e5c9dc4b7a652a02fcfa3100f97c0c00dd1055016af8d9261b7a54e

SHA512
d749ce57fd97d7ac07eb80d1169dbe18f32f85061af3d5de7d36dad33c7da16d97d7ddcf7a2e50d1b8af3b6198502a846a1e3b6018c5ba2592d33ddd6785da1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5827.exe

Filesize
468KB

MD5
e979ea0702f62fc70e19741921fd45fd

SHA1
1b8cce436e2c2de467bb80f19d7cb08789668bfa

SHA256
616338a8c1ec12b55c517ecc4dc6cef13ee1cfa034951da91815e2b35f4779dc

SHA512
f2ffa1eea4b1de2ec8139a78ca50bbe013d985b01cdd9a7dbb982cb785bc872707ad78f2c877ff838c4cac2663d38bde541061c2e22443790972a5e341f9cf3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe

Filesize
468KB

MD5
2a40230a2c007a164131eacdd13006d7

SHA1
a1bd5925b35195b658cdb2ac2beedf234033839b

SHA256
c132eb5fb3d455b9cbb89c58584d9ad3e6a3bdc1bf1f2c6dca071143172e0a56

SHA512
d97851930ec2a2fa06d8a2ca04512572af93de4d42ba92c04e83c423cc48217eca8373041e761022d54db3634886f92410720f11279a57d2688c3b828c97f451

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9166.exe

Filesize
468KB

MD5
fbe32aa9aaf25711f1abcac859eb0436

SHA1
482d2ccb9bb3783f37d1dd1be9d6d439b181f0d3

SHA256
50df8c065e62c31bd48af7610cdf84a34882e988608b6e9142a266d7c9d4c8fa

SHA512
cddb30bd28f0c25c64895910200ed7fa8f274ed2872f43505afcd0bc8be920c61e0a01f0b225b6fa9623820161c982ca3f1bfed149e9d084d7342d1bae949117

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10474.exe

Filesize
468KB

MD5
7e6f5c54fae2ba69dc7d7b7cd6b25198

SHA1
849f09b6674bc8e58bf47772b977b13f4efbb016

SHA256
5e0a686864404a5759eb7cdd4c2b3c09dbad985bcacc321f7e619d37c5c569da

SHA512
fefa82d19029a5767426694f41424ea560bc70d943c92bbc9ea8132c1377f72af96d37466f9291e7c2593879f4f9b26b50ac597ef6bc7cf9eeb523e7e2525b2d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe

Filesize
468KB

MD5
09de3076df53609d734de0438e8ff8dd

SHA1
f9f7a5ce39a6c29604d74111de6e12de6fd71964

SHA256
88a8ec49f2044514696bd516300576c4a926c4f47ebdb1549c16840d2163c49e

SHA512
bbd8949723643e5d354083575cdf1b46db9279f29ed71cf8b48a1ce367aed4c0ee4d276a8784c31c70eb5e7e49c4a687e2b2e63b410099bdfc5ef948511c8d31

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe

Filesize
468KB

MD5
215c92d588fb46ba085a2496433c2fd0

SHA1
abf5c61f631fca9b4984ece43edb81360285f380

SHA256
8159e741be56566195977684f7fc3caaa9eb91d5a4842ed57e6e28aec8b77c44

SHA512
6232f91cbcfd186406bc43ed21898e3a4b540acd854ddc478659e75f11b44d172dff0e120949af96fa4391291ac2b490fc2eca1eb80cefceb982f70fe8dac62d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28051.exe

Filesize
468KB

MD5
e883d9ba3d9087de5821d4b7f79719ab

SHA1
06f1df2b75ed659407c324edf5fcf83b9a7ca1f1

SHA256
022da3744a1e830fb8b10b67d0991693a18fe640dcf1fc7644a7715bee702f84

SHA512
41b43ec41ae6457f7cbbfa9c95b80a223ccb03231d2ffe7c74236625daf132312ce1e1b54390f273b4753f2693612beaf7132f98ea3a9f146816ab168ca8c73d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31449.exe

Filesize
468KB

MD5
11c3d4160f33c1d8147fd34849e82a04

SHA1
559c680fe9700918472f0f946ff4a4db8808dbff

SHA256
d52c9224093474469ca2e6c0a756c0fb21b3ab6ca8e11629197485dc9b2abe32

SHA512
b0600fa5864274d7553629c23cac21c6475d405e257a7500bdf21da7782a94967ce0a2d55a44c7a6fa3f1478d35c19129c762c403230db7b132a4df4bf52d25e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38911.exe

Filesize
468KB

MD5
87d9a6bc931c9bca37a9b43cd2bfd652

SHA1
24fd31bdab92fe3263874ca228f77f1a91a1893f

SHA256
d43b78b66b8d8411c24db7676a99cd3c47569792bff4c75e898eb3bc0c18f242

SHA512
42414b9985d4f7daa8218e2b737f305ef27403d628fd1c73b169ee6b8b59046d0e12b6b32f6a5fcaa9b1b07b4ad9854ba0aafc9f6f173d135bcd20e00b6b518d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45185.exe

Filesize
468KB

MD5
38b57879291e7e72fa77ad432ac7da75

SHA1
10e4f3e52556fadefe848e8f40aaf8ef6c58e9af

SHA256
e2a7dcd49335bca4f13b3b7712476deaa5184d88899fccf7d6a33da1b89bee71

SHA512
b90d21224fe32c8bd62dd37e8956c49ef83a7c37d7a2c913de4bff369503319f9a20d35d5c340408427bf11e94383611f6fbc151af9c8d7051525c3ba8baa372

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe

Filesize
468KB

MD5
db9ce8c500a829076abf9ec7d5ac78ae

SHA1
4039874e56d581cbf49422a2272a16ebe7c7aedb

SHA256
e774be252eb06af7c82c8d7d7abfb25afa06ebc48f05ad7c76401eba5086848c

SHA512
6bb338f0f50d943f66f74ffccf2e71cd8d074308eadb1118a20a1e39db807c896f0928077a2a78adcf93d5fb6a66995547084b714a022d4a7a74075a1b2714b4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe

Filesize
468KB

MD5
1eeb0d0fcc7d2dfbd6a0b77892c30876

SHA1
37ffc26a3d3994f858d1c36a74a29f0ee5471557

SHA256
88e09548239a4a89d9c77fb3fdb4dd61dd0ba568ceda9e91b8b4377d89a5b886

SHA512
e5137564f5233825b40508c5b563708f4e1c9bd7f696e9e5547e4d6709deae4afc0cb1e606bde258ea48205058631e99e879349f5e52a4fe8bf0125b1313996a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7905.exe

Filesize
468KB

MD5
cbcac809f2bb3a54ccbd54c45d2bcad5

SHA1
f7981452594a2ea5dfdbc5b9aa3c10b10f3a096e

SHA256
cdf8ef04eef8f46076eb63c4bd00f417df7303538a0ac0119040ee16bd746941

SHA512
875b68f9b359fc315963c849ef12362310877ab79766f2537ef217c2b3ca4b127517f4d5e2391f6bde35cc5c5757565aa850b901e45dabbfbd23bd18cd6e1520

Download Submit
memory/304-373-0x0000000003480000-0x00000000034F5000-memory.dmp

Filesize
468KB

Download
memory/872-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/880-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1040-361-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1040-153-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1292-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1520-299-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1520-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1520-300-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/1560-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1632-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1632-321-0x0000000000730000-0x00000000007A5000-memory.dmp

Filesize
468KB

Download
memory/1632-322-0x0000000000730000-0x00000000007A5000-memory.dmp

Filesize
468KB

Download
memory/1712-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1860-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1864-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1948-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1956-267-0x0000000001DD0000-0x0000000001E45000-memory.dmp

Filesize
468KB

Download
memory/1956-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1956-247-0x0000000001DD0000-0x0000000001E45000-memory.dmp

Filesize
468KB

Download
memory/2256-220-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2256-374-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2256-381-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2256-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-24-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2256-363-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2256-59-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2256-25-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2256-105-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2256-6-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2256-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-221-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2268-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2300-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2388-274-0x00000000027E0000-0x0000000002855000-memory.dmp

Filesize
468KB

Download
memory/2388-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2388-249-0x00000000027E0000-0x0000000002855000-memory.dmp

Filesize
468KB

Download
memory/2388-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2388-76-0x00000000027E0000-0x0000000002855000-memory.dmp

Filesize
468KB

Download
memory/2388-383-0x00000000027E0000-0x0000000002855000-memory.dmp

Filesize
468KB

Download
memory/2388-148-0x00000000027E0000-0x0000000002855000-memory.dmp

Filesize
468KB

Download
memory/2432-364-0x0000000001F20000-0x0000000001F95000-memory.dmp

Filesize
468KB

Download
memory/2432-362-0x0000000001F20000-0x0000000001F95000-memory.dmp

Filesize
468KB

Download
memory/2432-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2544-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2608-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2624-281-0x0000000001D30000-0x0000000001DA5000-memory.dmp

Filesize
468KB

Download
memory/2624-156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2624-277-0x0000000001D30000-0x0000000001DA5000-memory.dmp

Filesize
468KB

Download
memory/2636-99-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2636-211-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2636-204-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2640-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2716-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2724-150-0x0000000002460000-0x00000000024D5000-memory.dmp

Filesize
468KB

Download
memory/2724-57-0x0000000002460000-0x00000000024D5000-memory.dmp

Filesize
468KB

Download
memory/2724-240-0x0000000002460000-0x00000000024D5000-memory.dmp

Filesize
468KB

Download
memory/2724-239-0x0000000002460000-0x00000000024D5000-memory.dmp

Filesize
468KB

Download
memory/2724-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2740-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-295-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2752-168-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2752-296-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2824-149-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2824-48-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2824-43-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2824-298-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2824-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-147-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2824-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-305-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2844-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-250-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2844-269-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2944-403-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2944-108-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2972-429-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2988-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2992-416-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2992-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3012-348-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/3012-351-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/3028-350-0x0000000002510000-0x0000000002585000-memory.dmp

Filesize
468KB

Download
memory/3028-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3044-199-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/3044-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3044-341-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/3044-342-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/3056-248-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/3056-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-268-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/3056-162-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/3056-161-0x0000000001E50000-0x0000000001EC5000-memory.dmp

Filesize
468KB

Download
memory/3068-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download