8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 00:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe
Size

468KB
MD5

1c1bf72ca43c0e285702588d7bdbe195
SHA1

71cd781788685eb95167278a9c2c11b04a6c32dc
SHA256

8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83
SHA512

73f13e8af419e177b038fa137264c1d7d1c24db7d49d5355bd03c2e015c6ebd52f043a37d388718c0c8e38fcf8e54d78bbb2c6adb3c99bcdc94504c463343f9a
SSDEEP

3072:ToA1ogYnI05ptbUoPz4jef8/Eex7PgpXcmHe6VFn85lTWA4ukQSz:ToCom8ptvPEjefWcmg85NT4uk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2096	Unicorn-46371.exe
2380	Unicorn-13961.exe
1056	Unicorn-41651.exe
644	Unicorn-21816.exe
2940	Unicorn-8599.exe
2960	Unicorn-49973.exe
2136	Unicorn-28693.exe
2744	Unicorn-2064.exe
2344	Unicorn-5799.exe
1784	Unicorn-23907.exe
2420	Unicorn-56662.exe
2792	Unicorn-49693.exe
1876	Unicorn-57181.exe
2900	Unicorn-37580.exe
2072	Unicorn-57446.exe
1840	Unicorn-12379.exe
2248	Unicorn-19955.exe
2144	Unicorn-15280.exe
2120	Unicorn-28197.exe
2368	Unicorn-8612.exe
1844	Unicorn-13573.exe
1120	Unicorn-59245.exe
684	Unicorn-18182.exe
788	Unicorn-57356.exe
1448	Unicorn-10515.exe
1428	Unicorn-59432.exe
1232	Unicorn-52141.exe
1800	Unicorn-37388.exe
1608	Unicorn-2147.exe
2476	Unicorn-7495.exe
1928	Unicorn-32085.exe
1036	Unicorn-46104.exe
1860	Unicorn-46104.exe
896	Unicorn-26238.exe
972	Unicorn-39974.exe
1256	Unicorn-26238.exe
2556	Unicorn-28315.exe
1532	Unicorn-58388.exe
1472	Unicorn-6270.exe
2444	Unicorn-54054.exe
2868	Unicorn-22000.exe
2876	Unicorn-44838.exe
2992	Unicorn-63617.exe
2772	Unicorn-24112.exe
3020	Unicorn-17780.exe
2724	Unicorn-37646.exe
2892	Unicorn-30493.exe
1632	Unicorn-42254.exe
3032	Unicorn-26877.exe
3056	Unicorn-62036.exe
3028	Unicorn-17797.exe
296	Unicorn-63873.exe
324	Unicorn-9680.exe
396	Unicorn-277.exe
848	Unicorn-40135.exe
1052	Unicorn-13601.exe
2428	Unicorn-13601.exe
2496	Unicorn-33467.exe
2316	Unicorn-57700.exe
1336	Unicorn-27676.exe
1044	Unicorn-23657.exe
1440	Unicorn-61770.exe
2592	Unicorn-39387.exe
2524	Unicorn-22373.exe

Loads dropped DLL 64 IoCs

pid	Process
2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe
2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe
2096	Unicorn-46371.exe
2096	Unicorn-46371.exe
2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe
2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe
2380	Unicorn-13961.exe
2380	Unicorn-13961.exe
2096	Unicorn-46371.exe
1056	Unicorn-41651.exe
2096	Unicorn-46371.exe
1056	Unicorn-41651.exe
2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe
2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe
644	Unicorn-21816.exe
644	Unicorn-21816.exe
2096	Unicorn-46371.exe
2096	Unicorn-46371.exe
2136	Unicorn-28693.exe
2136	Unicorn-28693.exe
1056	Unicorn-41651.exe
1056	Unicorn-41651.exe
2960	Unicorn-49973.exe
2960	Unicorn-49973.exe
2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe
2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe
2940	Unicorn-8599.exe
2380	Unicorn-13961.exe
2940	Unicorn-8599.exe
2380	Unicorn-13961.exe
2744	Unicorn-2064.exe
2744	Unicorn-2064.exe
644	Unicorn-21816.exe
644	Unicorn-21816.exe
2344	Unicorn-5799.exe
2344	Unicorn-5799.exe
2096	Unicorn-46371.exe
2096	Unicorn-46371.exe
1784	Unicorn-23907.exe
1784	Unicorn-23907.exe
2072	Unicorn-57446.exe
2136	Unicorn-28693.exe
2072	Unicorn-57446.exe
2136	Unicorn-28693.exe
2420	Unicorn-56662.exe
2420	Unicorn-56662.exe
2940	Unicorn-8599.exe
2940	Unicorn-8599.exe
1056	Unicorn-41651.exe
1056	Unicorn-41651.exe
2792	Unicorn-49693.exe
2792	Unicorn-49693.exe
2960	Unicorn-49973.exe
2960	Unicorn-49973.exe
2900	Unicorn-37580.exe
2900	Unicorn-37580.exe
2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe
2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe
2380	Unicorn-13961.exe
2380	Unicorn-13961.exe
2248	Unicorn-19955.exe
2248	Unicorn-19955.exe
2144	Unicorn-15280.exe
1840	Unicorn-12379.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44838.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe
2096	Unicorn-46371.exe
2380	Unicorn-13961.exe
1056	Unicorn-41651.exe
644	Unicorn-21816.exe
2960	Unicorn-49973.exe
2136	Unicorn-28693.exe
2940	Unicorn-8599.exe
2744	Unicorn-2064.exe
2344	Unicorn-5799.exe
1784	Unicorn-23907.exe
2420	Unicorn-56662.exe
2792	Unicorn-49693.exe
1876	Unicorn-57181.exe
2900	Unicorn-37580.exe
2072	Unicorn-57446.exe
1840	Unicorn-12379.exe
2248	Unicorn-19955.exe
2144	Unicorn-15280.exe
2120	Unicorn-28197.exe
2368	Unicorn-8612.exe
1844	Unicorn-13573.exe
1120	Unicorn-59245.exe
684	Unicorn-18182.exe
788	Unicorn-57356.exe
1448	Unicorn-10515.exe
1800	Unicorn-37388.exe
1232	Unicorn-52141.exe
1428	Unicorn-59432.exe
1608	Unicorn-2147.exe
2476	Unicorn-7495.exe
972	Unicorn-39974.exe
1860	Unicorn-46104.exe
896	Unicorn-26238.exe
1928	Unicorn-32085.exe
1036	Unicorn-46104.exe
1532	Unicorn-58388.exe
1256	Unicorn-26238.exe
2556	Unicorn-28315.exe
2444	Unicorn-54054.exe
2868	Unicorn-22000.exe
1472	Unicorn-6270.exe
2876	Unicorn-44838.exe
2992	Unicorn-63617.exe
2772	Unicorn-24112.exe
3020	Unicorn-17780.exe
2724	Unicorn-37646.exe
2892	Unicorn-30493.exe
1632	Unicorn-42254.exe
3032	Unicorn-26877.exe
3056	Unicorn-62036.exe
3028	Unicorn-17797.exe
296	Unicorn-63873.exe
324	Unicorn-9680.exe
396	Unicorn-277.exe
848	Unicorn-40135.exe
1052	Unicorn-13601.exe
2428	Unicorn-13601.exe
1336	Unicorn-27676.exe
2316	Unicorn-57700.exe
2496	Unicorn-33467.exe
1044	Unicorn-23657.exe
1440	Unicorn-61770.exe
2592	Unicorn-39387.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2096	2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe	29
PID 2104 wrote to memory of 2096	2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe	29
PID 2104 wrote to memory of 2096	2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe	29
PID 2104 wrote to memory of 2096	2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe	29
PID 2096 wrote to memory of 2380	2096	Unicorn-46371.exe	30
PID 2096 wrote to memory of 2380	2096	Unicorn-46371.exe	30
PID 2096 wrote to memory of 2380	2096	Unicorn-46371.exe	30
PID 2096 wrote to memory of 2380	2096	Unicorn-46371.exe	30
PID 2104 wrote to memory of 1056	2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe	31
PID 2104 wrote to memory of 1056	2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe	31
PID 2104 wrote to memory of 1056	2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe	31
PID 2104 wrote to memory of 1056	2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe	31
PID 2380 wrote to memory of 2940	2380	Unicorn-13961.exe	32
PID 2380 wrote to memory of 2940	2380	Unicorn-13961.exe	32
PID 2380 wrote to memory of 2940	2380	Unicorn-13961.exe	32
PID 2380 wrote to memory of 2940	2380	Unicorn-13961.exe	32
PID 2096 wrote to memory of 644	2096	Unicorn-46371.exe	33
PID 2096 wrote to memory of 644	2096	Unicorn-46371.exe	33
PID 2096 wrote to memory of 644	2096	Unicorn-46371.exe	33
PID 2096 wrote to memory of 644	2096	Unicorn-46371.exe	33
PID 1056 wrote to memory of 2136	1056	Unicorn-41651.exe	34
PID 1056 wrote to memory of 2136	1056	Unicorn-41651.exe	34
PID 1056 wrote to memory of 2136	1056	Unicorn-41651.exe	34
PID 1056 wrote to memory of 2136	1056	Unicorn-41651.exe	34
PID 2104 wrote to memory of 2960	2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe	35
PID 2104 wrote to memory of 2960	2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe	35
PID 2104 wrote to memory of 2960	2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe	35
PID 2104 wrote to memory of 2960	2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe	35
PID 644 wrote to memory of 2744	644	Unicorn-21816.exe	36
PID 644 wrote to memory of 2744	644	Unicorn-21816.exe	36
PID 644 wrote to memory of 2744	644	Unicorn-21816.exe	36
PID 644 wrote to memory of 2744	644	Unicorn-21816.exe	36
PID 2096 wrote to memory of 2344	2096	Unicorn-46371.exe	37
PID 2096 wrote to memory of 2344	2096	Unicorn-46371.exe	37
PID 2096 wrote to memory of 2344	2096	Unicorn-46371.exe	37
PID 2096 wrote to memory of 2344	2096	Unicorn-46371.exe	37
PID 2136 wrote to memory of 1784	2136	Unicorn-28693.exe	38
PID 2136 wrote to memory of 1784	2136	Unicorn-28693.exe	38
PID 2136 wrote to memory of 1784	2136	Unicorn-28693.exe	38
PID 2136 wrote to memory of 1784	2136	Unicorn-28693.exe	38
PID 1056 wrote to memory of 2420	1056	Unicorn-41651.exe	39
PID 1056 wrote to memory of 2420	1056	Unicorn-41651.exe	39
PID 1056 wrote to memory of 2420	1056	Unicorn-41651.exe	39
PID 1056 wrote to memory of 2420	1056	Unicorn-41651.exe	39
PID 2960 wrote to memory of 2792	2960	Unicorn-49973.exe	40
PID 2960 wrote to memory of 2792	2960	Unicorn-49973.exe	40
PID 2960 wrote to memory of 2792	2960	Unicorn-49973.exe	40
PID 2960 wrote to memory of 2792	2960	Unicorn-49973.exe	40
PID 2104 wrote to memory of 1876	2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe	41
PID 2104 wrote to memory of 1876	2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe	41
PID 2104 wrote to memory of 1876	2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe	41
PID 2104 wrote to memory of 1876	2104	8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe	41
PID 2940 wrote to memory of 2072	2940	Unicorn-8599.exe	42
PID 2940 wrote to memory of 2072	2940	Unicorn-8599.exe	42
PID 2940 wrote to memory of 2072	2940	Unicorn-8599.exe	42
PID 2940 wrote to memory of 2072	2940	Unicorn-8599.exe	42
PID 2380 wrote to memory of 2900	2380	Unicorn-13961.exe	43
PID 2380 wrote to memory of 2900	2380	Unicorn-13961.exe	43
PID 2380 wrote to memory of 2900	2380	Unicorn-13961.exe	43
PID 2380 wrote to memory of 2900	2380	Unicorn-13961.exe	43
PID 2744 wrote to memory of 1840	2744	Unicorn-2064.exe	44
PID 2744 wrote to memory of 1840	2744	Unicorn-2064.exe	44
PID 2744 wrote to memory of 1840	2744	Unicorn-2064.exe	44
PID 2744 wrote to memory of 1840	2744	Unicorn-2064.exe	44

C:\Users\Admin\AppData\Local\Temp\8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe
"C:\Users\Admin\AppData\Local\Temp\8c6f6cc516630903c199ff8fc64837420752709995a6fe26fb70cef638483e83.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46371.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46371.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8599.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57446.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13573.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56617.exe
        8⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe
        8⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38758.exe
        8⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12597.exe
        8⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe
        8⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62229.exe
        8⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34796.exe
        7⤵
        
        PID:472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58049.exe
        7⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50386.exe
        7⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe
        7⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        7⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63873.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27308.exe
        7⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21828.exe
        8⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17051.exe
        8⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63551.exe
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-251.exe
        7⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16376.exe
        7⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exe
        6⤵
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37977.exe
        6⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4462.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        6⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57356.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52439.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17273.exe
        6⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12168.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55956.exe
        6⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62135.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57198.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23657.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11986.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22628.exe
        6⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58738.exe
        6⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4966.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7952.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45153.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
        5⤵
        
        PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37388.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24112.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47950.exe
        7⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54871.exe
        8⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22137.exe
        8⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22074.exe
        8⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8821.exe
        7⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
        7⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        7⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-251.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
        7⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35840.exe
        6⤵
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
        6⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61974.exe
        6⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6449.exe
        6⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7974.exe
        6⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7967.exe
        6⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17780.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7714.exe
        6⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52205.exe
        6⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        6⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-695.exe
        6⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14067.exe
        6⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
        5⤵
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19793.exe
        6⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63551.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49211.exe
        6⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11955.exe
        6⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7675.exe
        5⤵
        
        PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14473.exe
        5⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10242.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52483.exe
        5⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44945.exe
        5⤵
        
        PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7495.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3016.exe
        5⤵
        
        PID:700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24701.exe
        5⤵
        
        PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17273.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34211.exe
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
        5⤵
        
        PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63942.exe
      4⤵
      PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
      4⤵
      PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14575.exe
      4⤵
      PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61765.exe
      4⤵
      PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48468.exe
      4⤵
      PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19250.exe
      4⤵
      PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37495.exe
      4⤵
      PID:5248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2064.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12379.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46104.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16118.exe
        7⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26596.exe
        7⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20637.exe
        7⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
        7⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6507.exe
        7⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
        7⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20642.exe
        6⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54019.exe
        6⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33632.exe
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36002.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65100.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42669.exe
        6⤵
        
        PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26238.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
        6⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23131.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64573.exe
        6⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22973.exe
        6⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9477.exe
        5⤵
        
        PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
        5⤵
        
        PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        5⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
        5⤵
        
        PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32085.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20354.exe
        6⤵
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40636.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60342.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36289.exe
        6⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2919.exe
        5⤵
        
        PID:432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29836.exe
        6⤵
        
        PID:1456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5657.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40636.exe
        6⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28903.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-556.exe
        6⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13662.exe
        5⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
        5⤵
        
        PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57900.exe
        5⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28855.exe
        5⤵
        
        PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39974.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12692.exe
        5⤵
        
        PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26596.exe
        5⤵
        
        PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17273.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35443.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41015.exe
        5⤵
        
        PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
      4⤵
      PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
      4⤵
      PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33461.exe
      4⤵
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48468.exe
      4⤵
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38234.exe
      4⤵
      PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15608.exe
      4⤵
      PID:1604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5799.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15280.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46104.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12692.exe
        6⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26596.exe
        6⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17273.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35443.exe
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34211.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28930.exe
        5⤵
        
        PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34208.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2084.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26238.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50903.exe
        5⤵
        
        PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33153.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6449.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28038.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39387.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4966.exe
      4⤵
      PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14473.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36443.exe
      4⤵
      PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4462.exe
      4⤵
      PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
      4⤵
      PID:5596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28197.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28315.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        5⤵
        
        PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39323.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60849.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20155.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55968.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18582.exe
      4⤵
      PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61974.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6449.exe
      4⤵
      PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
      4⤵
      PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51819.exe
      4⤵
      PID:4624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58388.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
      4⤵
      PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19046.exe
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5952.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
      4⤵
      PID:5588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32586.exe
    3⤵
    PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
      4⤵
      PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40636.exe
      4⤵
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9084.exe
      4⤵
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe
      4⤵
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59471.exe
      4⤵
      PID:5504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20286.exe
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32308.exe
    3⤵
    PID:3984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45650.exe
    3⤵
    PID:3260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27651.exe
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11649.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41651.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41651.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23907.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8612.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6270.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36626.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        7⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50740.exe
        7⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        7⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3932.exe
        7⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3965.exe
        7⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23310.exe
        6⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60751.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6482.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41859.exe
        6⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54054.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29570.exe
        6⤵
        
        PID:272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38758.exe
        6⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34628.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-348.exe
        6⤵
        
        PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56966.exe
        5⤵
        
        PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34446.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5039.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61420.exe
        5⤵
        
        PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59245.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22000.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40135.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34464.exe
        7⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37004.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47646.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
        7⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe
        7⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58538.exe
        6⤵
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40778.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19412.exe
        6⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3932.exe
        6⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
        6⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13601.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57409.exe
        5⤵
        
        PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23139.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39420.exe
        5⤵
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8477.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37593.exe
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63617.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65384.exe
        5⤵
        
        PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44806.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6449.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49696.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62051.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
      4⤵
      PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36773.exe
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6979.exe
      4⤵
      PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50488.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29617.exe
      4⤵
      PID:4328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56662.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18182.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42254.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3929.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3538.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31968.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14617.exe
        6⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28490.exe
        6⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57409.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56605.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52934.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29990.exe
        5⤵
        
        PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26877.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
        5⤵
        
        PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42373.exe
        5⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9249.exe
        5⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe
        5⤵
        
        PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exe
      4⤵
      PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20712.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13380.exe
      4⤵
      PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
      4⤵
      PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51277.exe
      4⤵
      PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54574.exe
      4⤵
      PID:4412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10515.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53928.exe
        5⤵
        
        PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42373.exe
        5⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44672.exe
        5⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10014.exe
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4386.exe
        5⤵
        
        PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55414.exe
      4⤵
      PID:772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22045.exe
      4⤵
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37260.exe
      4⤵
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
      4⤵
      PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40520.exe
      4⤵
      PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47950.exe
      4⤵
      PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
      4⤵
      PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
      4⤵
      PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49787.exe
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
      4⤵
      PID:5000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
    3⤵
    PID:2332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
    3⤵
    PID:2152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53839.exe
    3⤵
    PID:4024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50985.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
    3⤵
    PID:4916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
    3⤵
    PID:4960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49693.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59432.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62036.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60628.exe
        6⤵
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40636.exe
        6⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8702.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        6⤵
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55414.exe
        5⤵
        
        PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12351.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22045.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24238.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47211.exe
        5⤵
        
        PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13358.exe
        5⤵
        
        PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63551.exe
        5⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-251.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38487.exe
        5⤵
        
        PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exe
      4⤵
      PID:1904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
      4⤵
      PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53829.exe
      4⤵
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
      4⤵
      PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61323.exe
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
      4⤵
      PID:4112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52141.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33467.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47950.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
        5⤵
        
        PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63935.exe
        5⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        5⤵
        
        PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41789.exe
      4⤵
      PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
      4⤵
      PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61974.exe
      4⤵
      PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17240.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6449.exe
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33251.exe
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31133.exe
      4⤵
      PID:2656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17935.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22115.exe
      4⤵
      PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48741.exe
      4⤵
      PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29572.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19186.exe
      4⤵
      PID:4108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14182.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7952.exe
    3⤵
    PID:3376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
    3⤵
    PID:3848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11649.exe
    3⤵
    PID:4840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57181.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57181.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44838.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22373.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        5⤵
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7056.exe
        6⤵
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59579.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31290.exe
        6⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27042.exe
        5⤵
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7839.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64621.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7947.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe
        5⤵
        
        PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
      4⤵
      PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40778.exe
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44623.exe
      4⤵
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3932.exe
      4⤵
      PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10301.exe
      4⤵
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44676.exe
      4⤵
      PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64919.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64919.exe
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8614.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47940.exe
    3⤵
    PID:3528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55686.exe
    3⤵
    PID:3900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4462.exe
    3⤵
    PID:4280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
    3⤵
    PID:4388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24655.exe
    3⤵
    PID:5368
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2147.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2147.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37646.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37646.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
      4⤵
      PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
      4⤵
      PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17273.exe
      4⤵
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60108.exe
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55956.exe
      4⤵
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6274.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
    3⤵
    PID:1524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23310.exe
    3⤵
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64783.exe
    3⤵
    PID:3736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
    3⤵
    PID:3336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
    3⤵
    PID:4908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40520.exe
    3⤵
    PID:4556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8537.exe
    3⤵
    PID:2952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27287.exe
    3⤵
    PID:3396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
    3⤵
    PID:3264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51650.exe
    3⤵
    PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
    3⤵
    PID:4700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1342.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1342.exe
  2⤵
  PID:1980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29261.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29261.exe
  2⤵
  PID:816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
  2⤵
  PID:3484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2103.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2103.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50294.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50294.exe
  2⤵
  PID:4712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11115.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11115.exe
  2⤵
  PID:4964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12379.exe

Filesize
468KB

MD5
688f264abccdfc4a7b4300e10e9ab76f

SHA1
34b73880f04ce36a5aa1b57b379aca2906b29b27

SHA256
d41edda3bd8176cc3ffc7115d180299c5a8be93ec47d4383d5b3d5ece08f4e64

SHA512
9a9d1373ebf152452bf12d5bc3570d20879201e7d947fa0e0925c15d2e3660ae94ba8c7165b5a278774fd8076a544ead242c7dbac830d12e030279cacdd32fca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23907.exe

Filesize
468KB

MD5
3110ba2ef84a10c95e0aba7f539e5d23

SHA1
42f96669f03502b56c494ed740dde3c381d9f870

SHA256
f5be705804db286c111b110be276a771674a2e930aa3814a385b388ff61dcced

SHA512
b3dd2648cbc45fd10c6ff82083bda8a79e6cffa5964126793c8b8231fc806d5a95988632d1e1c12b8f66a87d6bc16dc29df6e55fad047946d2762b47b22529d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe

Filesize
468KB

MD5
3026b8f4c1ec92a535019e06e291b03f

SHA1
3dc7984ac72cff18198f2e3fe3702300bcaae1cd

SHA256
5cf2e9d85bd84ce78df2814704e06a7b60637ac150b3a6558c464deb708c3b85

SHA512
c79f69becbf6f5a9bab03be53c5bdca679c739b806fc6f36b5b800120ba3c01a09376a42a9e0dd548bf739cbafbca58e52ea9c30b9770e6c44c3943b97a45abf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe

Filesize
468KB

MD5
3aaae7dbd31d50792c2ea6ca3151060e

SHA1
0e1fba4f3eea4fc6f71417529db91c90024ff3ed

SHA256
21ec136ff756e639b13736c90c4364796f01e0dd49a5f92cb6f8fb02f3ce4efd

SHA512
3285da1f41f371c59981ce3a77b69b5a04ae56b0e38cc88c2d0442489e6ec5e76f5d738c217902165cd61969338404f57f56d8a2543f8e6e1d56dd8fd185f29c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe

Filesize
468KB

MD5
421b8add15eaa8c7fbc3d1c378ffdcc6

SHA1
b55df702583209fc31a4fc1fcb14e74f05baddd3

SHA256
ed681738d27514f85a4252ba3edb2c2b69caccbf960705a8ed43bd9654a2ecd4

SHA512
b78e34f6abf29fee0334258f0214f47581f042323f72e9b58265d1a4053ebe0e1d100070cc92e57e5c37f3ce828b299327aada718572f88153af1104e8057c8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42254.exe

Filesize
468KB

MD5
c865d112fe5fcb8d2f4d0017742bf859

SHA1
6c9d0612d1c94bd434c09a32f6886cf053957267

SHA256
f81e4609300246e04023d010de31e8fa9b59f99c947b6a4f6833ed2bbd0f640e

SHA512
01d3749376f8c066031af23fca116b6322af0208d0f64bf92e096d3377659a245fc221cb98a2c793e7716192856dce864bb717d26f544cbfe70614e549846757

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56662.exe

Filesize
468KB

MD5
896a899ac1099b7efeecaf0ef5060497

SHA1
67e82c4680230c347c75c07b4f63c7ada9b0d7ca

SHA256
9df7397f8ca6fe7a43a379e0c416d019339f47eb62b44b4e98591181d2f5378c

SHA512
fef4135700420160d51f893d87027ac7c5f2911dc49c75c0709062cb87b3d3adcdb53806eb0336af72b7fbf61b5bd36017ca0157edfcd910921b564880c082ca

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe

Filesize
468KB

MD5
03980df53d01d932505f3f71a6beb41e

SHA1
997fca459383941138b100b65d884658e972de53

SHA256
a2da4f2d0477cb0f4c83cd6d83ca5921859394457c95595eb8fac62c86b400e4

SHA512
d8beaf9ce1364338b05dea51c95c5c357c5c7f1b6699bcca934e43c64006cee13e5246f544c0f98b6d3df2b4455ab32281ada7ba9f73dc4e1770856e9d1e462d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15280.exe

Filesize
468KB

MD5
f92c2e8eeb4a1adcab7651c2e7266cb5

SHA1
eda3d31d01297f678862a96f1f37e676229b00f6

SHA256
2d48024a21f038c06f6b197d5b3500318bb61ec030932221cb7ac62aba790aa9

SHA512
6a26d6d057c7e83688467c6cc617f97fc8df364c21cb862f34a968a807e7a30aff8347fcc86f97fe833bad26caf77f3f47e85d2ab3b2094598b468a963f2f2c9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe

Filesize
468KB

MD5
9a0b1964c0cb9661dbaff32041af6f2f

SHA1
3051bd7461391ab180e0cece542ee2dad94d695c

SHA256
602065f0cfcd5a04145a76222f25c7e818f31e675c35256ce5968381164d16a5

SHA512
af46e4ce4da911e0272410f91a85df8f0a1941f6999503f520290647c74ce62685f9859a7ffcbf2eb8172d47d3109d27d9d3648a6b7b8f1b049184782f6d9fbb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2064.exe

Filesize
468KB

MD5
8bd38420a9f7e43620b7384750266d77

SHA1
3a62df783a477547685c86caa89e0fb3b3a80a29

SHA256
255b16b322d615e62b7f585846d6a49030ec59e509139f0e9a39b2b4afc0bbcb

SHA512
88f86072d93dcb5d428eaa4a8caf5a18ca61a2c759f2a3ef6cc18762ba52d3cc5ef14a1cbccce5a641a5f475a5503b230af6b0e14ce63fb9d092107684a6a5fd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe

Filesize
468KB

MD5
070946b1acc22fa9ef23c2b92e8db1db

SHA1
095c18374cdfca4f66782c6d9543005312ad5b56

SHA256
9aadba8b71e928b6ca6ba195ab99f608f3da7c1df062d0c86b72339bd8cbc35e

SHA512
a8dc3d630100f2dfe671617d6c5a8e4991fb07a5e4746bdd8885bea166c401612cb076bfe85dad5ecf2b2f554e7f4c1a2bd8ff7acdd6474264a4b195f46f5933

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28197.exe

Filesize
468KB

MD5
d8b527cb02bd3faf3076c46824d6cc70

SHA1
9a45ac547e8612c6a31843060ed03517d631f2a9

SHA256
44812197a9d2d493aa59ca5482c8cb0953c0907c14a676c57317694dc6ef830b

SHA512
c7af0109c6fb1857058c8e653cf070256c169679a48313b2f703b749e713beee626da86c0956a3df084b9ff9df17fee3ae572bae85a69ed16c10254f89c6cabc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41651.exe

Filesize
468KB

MD5
6b53dd4138e3a41c84eab247bda156ca

SHA1
247149a30b1d5a4aacb79d5ad21ee159554503e0

SHA256
6f17f9faf4868de9652f7f5743227c1b72c3f7958e481de2d771fc8aed825acc

SHA512
b2c9568e3ead49e9e1491e0e11ab4e111ce75555b03c8dc4ddfd4371c66579c6cf82d0c0915ab380789e2f1e170878f4f14eb37505734c5831f70be64e9d58ae

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46371.exe

Filesize
468KB

MD5
99b11de267ff13c3916b0d59ef5cd299

SHA1
f7e1f937308e456030c2d3e67f54da339010322f

SHA256
a1ca13db175ec69bad54d6466d2f0833cdbc308023717f4265f2e3c59732aab5

SHA512
92447cc6609cea2f725b23a41254db83bf6c440820484eb1c456d5052f42b75ea75c315ed1a7f092b4c4a527ff3c21551ef38aae2c5fd933cd840c6ee3944eba

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49693.exe

Filesize
468KB

MD5
9a0d3988b7b1c9e709ca797a45bc2982

SHA1
3b13e96ebd8ae9a13cdbe12a7abeeefe8d7634f1

SHA256
8218d093e4c5db4d6ca7d01f6b065292648c935f3275c7131124c32420d945ba

SHA512
8c5b6262b925898af50ceb598a7356592f832cbf439b4284aa71bd7cacea44d66369b3ba841c3db4b08e9aceda462e594fc3dce7633a6c47127495967ce2ce30

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe

Filesize
468KB

MD5
405088ba8e47a898f6700d56073db253

SHA1
2769fadacffa9445459aec03c235c59b921e50f0

SHA256
536259cec3c885f675a2829c1f57b16be3a3c34251f4a1baba720fbb0deda477

SHA512
62df04036487abe1b778b0b8ce9d8dda8e780ec5ebeae379182def609159e8c0073eddd945d820d72bccbd31995ab95a03e03b9e660a87f8d161a357a4754340

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57181.exe

Filesize
468KB

MD5
9d32a3660a90994db87d080642eae080

SHA1
596f9901ae68809a6a152df1b948d2d1b35a7701

SHA256
9e6a89022d5e87f573e8555cbdb81702615d6a76b736367ec29ffcf9445a8fa3

SHA512
2b8754e7a05cb0c8ec17239d82bf067708e358b6f4a978d9e1044c315b2e2f6c2e9e492eaddd40f09bb666d88d6b04451f373ab37d59422886e6b8583aaf9586

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57446.exe

Filesize
468KB

MD5
697246570608afdb84fb47ebd9f45a23

SHA1
58d4af257ece4a593bd7770decb8c5496e827575

SHA256
9f72b77e6a25c09fb6326d539c6248a1a1b49b071cf4198ed50ebae16027bc7c

SHA512
f88f7aea0c12cb0b7ee1eaf9c42fe6f4cefec231ead946a69e162cbe6c14a45020030e70c9dbb596ff4fe1cfb6d59da0c3cefb4e5292496d58443dd5eb1353ca

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5799.exe

Filesize
468KB

MD5
50a375bdd243e0f63c76b8e930834550

SHA1
40fd5c4c313c6338cf1312abf4ad6b8996320cd2

SHA256
7ce182e04b77ad219a3281242290f4dda73e23959b661724def9dca58997c5bc

SHA512
4b518cd85db689c4c5de924e26c955909f3fb6675fa58ae1b32dbe031b1880cdf5d830a284083e48cfeb4de431250e975e08f678b3b396311d79c2c40e0a00d2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8599.exe

Filesize
468KB

MD5
0dc3cda33c7f94efb865f27fdce7325b

SHA1
abd40b73d2c6b970a8659993cb3621e3bbcbc2eb

SHA256
0526f66e96da09005a3d5b86b28d4db1badadc80d44059c6895d0b5456f623cf

SHA512
f7aeff448f3bc80d5143747cea898910afa78103975fb93f7bff10cc3d93b64688bc9c045f0c909be94cf16284186557f001ed586fdb2bac6de64df3136382c7

Download Submit