31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790

Analysis

max time kernel
118s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 19:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe
Size

468KB
MD5

d2261ae29f18a400d173749685214d70
SHA1

5ddb4912f0139ec4c67355a8a9b4be3abce41f61
SHA256

31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790
SHA512

a2d83a10cbb4928c23871a6839debb11e3eae25fecbd1676a0f825c87e4e15d338a2f81f27b528845390ab849ee2655466ecec375ee4c2cd5e06861659ec35f5
SSDEEP

3072:zDDKowLNjy8U6bY5fzsjYf5/lhAoIpBnmHeAVs7JpXXX2yNTHlT:zDmoILU6SfwjYfx039JpHGyNT

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1920	Unicorn-55299.exe
2756	Unicorn-47178.exe
2836	Unicorn-58039.exe
2644	Unicorn-3213.exe
2748	Unicorn-48885.exe
2936	Unicorn-38024.exe
3048	Unicorn-9335.exe
1140	Unicorn-29939.exe
2240	Unicorn-40799.exe
2796	Unicorn-50359.exe
2012	Unicorn-47598.exe
1752	Unicorn-48989.exe
2908	Unicorn-65060.exe
2904	Unicorn-59195.exe
316	Unicorn-60748.exe
2312	Unicorn-32059.exe
1944	Unicorn-3379.exe
2992	Unicorn-4702.exe
864	Unicorn-29206.exe
1228	Unicorn-49072.exe
1724	Unicorn-4510.exe
1760	Unicorn-28460.exe
928	Unicorn-9985.exe
320	Unicorn-27697.exe
1400	Unicorn-18154.exe
588	Unicorn-29014.exe
2572	Unicorn-55002.exe
1616	Unicorn-60867.exe
2552	Unicorn-61132.exe
2812	Unicorn-13467.exe
2844	Unicorn-48833.exe
1068	Unicorn-27666.exe
2660	Unicorn-5662.exe
2840	Unicorn-21444.exe
2328	Unicorn-13175.exe
2228	Unicorn-54116.exe
2188	Unicorn-4915.exe
2116	Unicorn-22574.exe
2712	Unicorn-7629.exe
2700	Unicorn-54692.exe
1824	Unicorn-48562.exe
904	Unicorn-1142.exe
1340	Unicorn-64898.exe
2176	Unicorn-24027.exe
2296	Unicorn-25227.exe
2340	Unicorn-49731.exe
1128	Unicorn-13529.exe
1684	Unicorn-49731.exe
2164	Unicorn-60592.exe
1676	Unicorn-49731.exe
1560	Unicorn-65408.exe
2672	Unicorn-19471.exe
1624	Unicorn-31989.exe
1284	Unicorn-48325.exe
2064	Unicorn-55731.exe
2300	Unicorn-47363.exe
2020	Unicorn-11376.exe
2876	Unicorn-35881.exe
2688	Unicorn-29750.exe
1556	Unicorn-4339.exe
2940	Unicorn-54931.exe
2580	Unicorn-59570.exe
2856	Unicorn-52793.exe
2500	Unicorn-17983.exe

Loads dropped DLL 64 IoCs

pid	Process
2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe
2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe
1920	Unicorn-55299.exe
1920	Unicorn-55299.exe
2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe
2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe
2836	Unicorn-58039.exe
2756	Unicorn-47178.exe
2836	Unicorn-58039.exe
1920	Unicorn-55299.exe
2756	Unicorn-47178.exe
1920	Unicorn-55299.exe
2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe
2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe
2644	Unicorn-3213.exe
2644	Unicorn-3213.exe
2836	Unicorn-58039.exe
2836	Unicorn-58039.exe
2936	Unicorn-38024.exe
2936	Unicorn-38024.exe
2756	Unicorn-47178.exe
2756	Unicorn-47178.exe
3048	Unicorn-9335.exe
3048	Unicorn-9335.exe
2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe
1920	Unicorn-55299.exe
2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe
1920	Unicorn-55299.exe
2240	Unicorn-40799.exe
2240	Unicorn-40799.exe
2836	Unicorn-58039.exe
2836	Unicorn-58039.exe
1140	Unicorn-29939.exe
1140	Unicorn-29939.exe
2644	Unicorn-3213.exe
2644	Unicorn-3213.exe
2748	Unicorn-48885.exe
2748	Unicorn-48885.exe
2796	Unicorn-50359.exe
2796	Unicorn-50359.exe
2936	Unicorn-38024.exe
2936	Unicorn-38024.exe
2908	Unicorn-65060.exe
2908	Unicorn-65060.exe
1752	Unicorn-48989.exe
1752	Unicorn-48989.exe
2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe
2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe
2012	Unicorn-47598.exe
2012	Unicorn-47598.exe
3048	Unicorn-9335.exe
3048	Unicorn-9335.exe
1920	Unicorn-55299.exe
2756	Unicorn-47178.exe
2904	Unicorn-59195.exe
1920	Unicorn-55299.exe
2756	Unicorn-47178.exe
2904	Unicorn-59195.exe
316	Unicorn-60748.exe
316	Unicorn-60748.exe
2240	Unicorn-40799.exe
2240	Unicorn-40799.exe
1944	Unicorn-3379.exe
1944	Unicorn-3379.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52793.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21164.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe
1920	Unicorn-55299.exe
2756	Unicorn-47178.exe
2836	Unicorn-58039.exe
2644	Unicorn-3213.exe
2748	Unicorn-48885.exe
2936	Unicorn-38024.exe
3048	Unicorn-9335.exe
2240	Unicorn-40799.exe
1140	Unicorn-29939.exe
2796	Unicorn-50359.exe
1752	Unicorn-48989.exe
2012	Unicorn-47598.exe
2908	Unicorn-65060.exe
2904	Unicorn-59195.exe
316	Unicorn-60748.exe
1944	Unicorn-3379.exe
2312	Unicorn-32059.exe
2992	Unicorn-4702.exe
864	Unicorn-29206.exe
1228	Unicorn-49072.exe
1724	Unicorn-4510.exe
1760	Unicorn-28460.exe
928	Unicorn-9985.exe
320	Unicorn-27697.exe
1400	Unicorn-18154.exe
588	Unicorn-29014.exe
2552	Unicorn-61132.exe
1616	Unicorn-60867.exe
2572	Unicorn-55002.exe
2812	Unicorn-13467.exe
2844	Unicorn-48833.exe
1068	Unicorn-27666.exe
2660	Unicorn-5662.exe
2840	Unicorn-21444.exe
2328	Unicorn-13175.exe
2228	Unicorn-54116.exe
2116	Unicorn-22574.exe
2188	Unicorn-4915.exe
2712	Unicorn-7629.exe
2700	Unicorn-54692.exe
1824	Unicorn-48562.exe
1340	Unicorn-64898.exe
904	Unicorn-1142.exe
2176	Unicorn-24027.exe
2296	Unicorn-25227.exe
2164	Unicorn-60592.exe
2340	Unicorn-49731.exe
1676	Unicorn-49731.exe
1684	Unicorn-49731.exe
1128	Unicorn-13529.exe
1560	Unicorn-65408.exe
2672	Unicorn-19471.exe
1624	Unicorn-31989.exe
1284	Unicorn-48325.exe
2064	Unicorn-55731.exe
2300	Unicorn-47363.exe
2020	Unicorn-11376.exe
2876	Unicorn-35881.exe
2688	Unicorn-29750.exe
1556	Unicorn-4339.exe
2940	Unicorn-54931.exe
2580	Unicorn-59570.exe
1972	Unicorn-30134.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1920	2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe	29
PID 2360 wrote to memory of 1920	2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe	29
PID 2360 wrote to memory of 1920	2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe	29
PID 2360 wrote to memory of 1920	2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe	29
PID 1920 wrote to memory of 2756	1920	Unicorn-55299.exe	30
PID 1920 wrote to memory of 2756	1920	Unicorn-55299.exe	30
PID 1920 wrote to memory of 2756	1920	Unicorn-55299.exe	30
PID 1920 wrote to memory of 2756	1920	Unicorn-55299.exe	30
PID 2360 wrote to memory of 2836	2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe	31
PID 2360 wrote to memory of 2836	2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe	31
PID 2360 wrote to memory of 2836	2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe	31
PID 2360 wrote to memory of 2836	2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe	31
PID 2836 wrote to memory of 2644	2836	Unicorn-58039.exe	32
PID 2836 wrote to memory of 2644	2836	Unicorn-58039.exe	32
PID 2836 wrote to memory of 2644	2836	Unicorn-58039.exe	32
PID 2836 wrote to memory of 2644	2836	Unicorn-58039.exe	32
PID 2756 wrote to memory of 2936	2756	Unicorn-47178.exe	33
PID 2756 wrote to memory of 2936	2756	Unicorn-47178.exe	33
PID 2756 wrote to memory of 2936	2756	Unicorn-47178.exe	33
PID 2756 wrote to memory of 2936	2756	Unicorn-47178.exe	33
PID 1920 wrote to memory of 2748	1920	Unicorn-55299.exe	34
PID 1920 wrote to memory of 2748	1920	Unicorn-55299.exe	34
PID 1920 wrote to memory of 2748	1920	Unicorn-55299.exe	34
PID 1920 wrote to memory of 2748	1920	Unicorn-55299.exe	34
PID 2360 wrote to memory of 3048	2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe	35
PID 2360 wrote to memory of 3048	2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe	35
PID 2360 wrote to memory of 3048	2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe	35
PID 2360 wrote to memory of 3048	2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe	35
PID 2644 wrote to memory of 1140	2644	Unicorn-3213.exe	36
PID 2644 wrote to memory of 1140	2644	Unicorn-3213.exe	36
PID 2644 wrote to memory of 1140	2644	Unicorn-3213.exe	36
PID 2644 wrote to memory of 1140	2644	Unicorn-3213.exe	36
PID 2836 wrote to memory of 2240	2836	Unicorn-58039.exe	37
PID 2836 wrote to memory of 2240	2836	Unicorn-58039.exe	37
PID 2836 wrote to memory of 2240	2836	Unicorn-58039.exe	37
PID 2836 wrote to memory of 2240	2836	Unicorn-58039.exe	37
PID 2936 wrote to memory of 2796	2936	Unicorn-38024.exe	38
PID 2936 wrote to memory of 2796	2936	Unicorn-38024.exe	38
PID 2936 wrote to memory of 2796	2936	Unicorn-38024.exe	38
PID 2936 wrote to memory of 2796	2936	Unicorn-38024.exe	38
PID 2756 wrote to memory of 2012	2756	Unicorn-47178.exe	39
PID 2756 wrote to memory of 2012	2756	Unicorn-47178.exe	39
PID 2756 wrote to memory of 2012	2756	Unicorn-47178.exe	39
PID 2756 wrote to memory of 2012	2756	Unicorn-47178.exe	39
PID 3048 wrote to memory of 1752	3048	Unicorn-9335.exe	40
PID 3048 wrote to memory of 1752	3048	Unicorn-9335.exe	40
PID 3048 wrote to memory of 1752	3048	Unicorn-9335.exe	40
PID 3048 wrote to memory of 1752	3048	Unicorn-9335.exe	40
PID 2360 wrote to memory of 2908	2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe	41
PID 2360 wrote to memory of 2908	2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe	41
PID 2360 wrote to memory of 2908	2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe	41
PID 2360 wrote to memory of 2908	2360	31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe	41
PID 1920 wrote to memory of 2904	1920	Unicorn-55299.exe	42
PID 1920 wrote to memory of 2904	1920	Unicorn-55299.exe	42
PID 1920 wrote to memory of 2904	1920	Unicorn-55299.exe	42
PID 1920 wrote to memory of 2904	1920	Unicorn-55299.exe	42
PID 2240 wrote to memory of 316	2240	Unicorn-40799.exe	43
PID 2240 wrote to memory of 316	2240	Unicorn-40799.exe	43
PID 2240 wrote to memory of 316	2240	Unicorn-40799.exe	43
PID 2240 wrote to memory of 316	2240	Unicorn-40799.exe	43
PID 2836 wrote to memory of 2312	2836	Unicorn-58039.exe	44
PID 2836 wrote to memory of 2312	2836	Unicorn-58039.exe	44
PID 2836 wrote to memory of 2312	2836	Unicorn-58039.exe	44
PID 2836 wrote to memory of 2312	2836	Unicorn-58039.exe	44

C:\Users\Admin\AppData\Local\Temp\31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe
"C:\Users\Admin\AppData\Local\Temp\31645e2a27f9e006529dbd9041e5923ad0828bc6ec52d15794bbffd8bb18c790N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55299.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55299.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38024.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54692.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32565.exe
        8⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3815.exe
        9⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
        9⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        9⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        9⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        9⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9090.exe
        8⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16250.exe
        8⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        8⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        8⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43796.exe
        8⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55678.exe
        7⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19960.exe
        8⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
        8⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-403.exe
        8⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        8⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36196.exe
        7⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48500.exe
        7⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26349.exe
        7⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31163.exe
        7⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22451.exe
        7⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
        8⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        8⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        8⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        8⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18568.exe
        7⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16250.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        7⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        7⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36741.exe
        6⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
        7⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54970.exe
        7⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17096.exe
        7⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27467.exe
        7⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28691.exe
        6⤵
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13450.exe
        6⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
        6⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31163.exe
        6⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4510.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7629.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
        7⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
        8⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21949.exe
        8⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        8⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        8⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31456.exe
        7⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18964.exe
        7⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        7⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        7⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44002.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        7⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36941.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        7⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        7⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        7⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36196.exe
        6⤵
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64710.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27998.exe
        6⤵
        
        PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64898.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40925.exe
        6⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18206.exe
        7⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        7⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        7⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
        7⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12538.exe
        6⤵
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        6⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        6⤵
        
        PID:7584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        5⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
        7⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
        7⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65063.exe
        7⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        7⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        7⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55050.exe
        6⤵
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        6⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        6⤵
        
        PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
        5⤵
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe
        6⤵
        
        PID:700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8466.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        6⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        6⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        6⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
        5⤵
        
        PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2029.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52335.exe
        5⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39974.exe
        5⤵
        
        PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47598.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18154.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25227.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        7⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
        7⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        7⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        7⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27467.exe
        7⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1298.exe
        6⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35983.exe
        7⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe
        6⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        6⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        6⤵
        
        PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13529.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        6⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59539.exe
        7⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8466.exe
        7⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        7⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36466.exe
        6⤵
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        6⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        6⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62288.exe
        5⤵
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        6⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6490.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        5⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        5⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe
        5⤵
        
        PID:7504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55002.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18580.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        6⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        6⤵
        
        PID:7328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26845.exe
        5⤵
        
        PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        5⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        5⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        5⤵
        
        PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19471.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54687.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        5⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        5⤵
        
        PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe
      4⤵
      PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50501.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8329.exe
      4⤵
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
      4⤵
      PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
      4⤵
      PID:6836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48885.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29206.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21444.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52793.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20152.exe
        7⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe
        7⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33076.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        7⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        6⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36287.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        6⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        6⤵
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16399.exe
        5⤵
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30074.exe
        6⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3168.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22962.exe
        6⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        6⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        6⤵
        
        PID:7576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18297.exe
        5⤵
        
        PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24446.exe
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe
        5⤵
        
        PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13175.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48408.exe
        5⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        6⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        7⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18580.exe
        7⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        7⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4902.exe
        7⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        6⤵
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        6⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13742.exe
        5⤵
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48940.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        6⤵
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe
        5⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        5⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        5⤵
        
        PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24516.exe
      4⤵
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        5⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        5⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        5⤵
        
        PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
      4⤵
      PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
      4⤵
      PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63150.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
      4⤵
      PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
      4⤵
      PID:6844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59195.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
        6⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21949.exe
        7⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        7⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        7⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19299.exe
        7⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62375.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37404.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15540.exe
        6⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64946.exe
        6⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8506.exe
        5⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        6⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3460.exe
        6⤵
        
        PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10573.exe
        5⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57165.exe
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32606.exe
        5⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
        5⤵
        
        PID:7436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        5⤵
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42134.exe
        6⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
        6⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21015.exe
        6⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        6⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        6⤵
        
        PID:7456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38412.exe
        5⤵
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        6⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36133.exe
        6⤵
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        5⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        5⤵
        
        PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64644.exe
      4⤵
      PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32884.exe
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
      4⤵
      PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
      4⤵
      PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31163.exe
      4⤵
      PID:6772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31989.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28372.exe
        5⤵
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21164.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20882.exe
        7⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        6⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63327.exe
        5⤵
        
        PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        5⤵
        
        PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        5⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        5⤵
        
        PID:7592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61599.exe
      4⤵
      PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        5⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22812.exe
        5⤵
        
        PID:7448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57165.exe
      4⤵
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14296.exe
      4⤵
      PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
      4⤵
      PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27998.exe
      4⤵
      PID:7368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55731.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60141.exe
      4⤵
      PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
      4⤵
      PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44643.exe
      4⤵
      PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
      4⤵
      PID:7636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29221.exe
    3⤵
    PID:2784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2029.exe
    3⤵
    PID:3688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52335.exe
    3⤵
    PID:4988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39974.exe
    3⤵
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe
    3⤵
    PID:7416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58039.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58039.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3213.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3379.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35881.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64697.exe
        8⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42371.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56624.exe
        8⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        8⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        8⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        8⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47785.exe
        7⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21281.exe
        8⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18426.exe
        8⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        8⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        7⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        7⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4339.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33499.exe
        7⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10429.exe
        8⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        8⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        8⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        7⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30082.exe
        6⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10164.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        6⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42051.exe
        6⤵
        
        PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5662.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44817.exe
        6⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
        7⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44643.exe
        7⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        7⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        7⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        6⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        6⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        6⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
        5⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24379.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        6⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3460.exe
        6⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32583.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
        5⤵
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31163.exe
        5⤵
        
        PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4702.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18367.exe
        6⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        7⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46711.exe
        8⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
        8⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44643.exe
        8⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        8⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe
        7⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        7⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        7⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        7⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21334.exe
        6⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50219.exe
        7⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
        7⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        7⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27467.exe
        7⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18022.exe
        6⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10164.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        6⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27998.exe
        6⤵
        
        PID:7336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12699.exe
        5⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46794.exe
        6⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49325.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        6⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60862.exe
        6⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35078.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24830.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
        5⤵
        
        PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        5⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        5⤵
        
        PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7484.exe
        5⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
        6⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45110.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        6⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        6⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26928.exe
        5⤵
        
        PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        5⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        5⤵
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20239.exe
      4⤵
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-909.exe
        5⤵
        
        PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51550.exe
        5⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        5⤵
        
        PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21143.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31341.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33306.exe
      4⤵
      PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65247.exe
      4⤵
      PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe
      4⤵
      PID:7424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13467.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5813.exe
        7⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        8⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        8⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        8⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        8⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62375.exe
        7⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49325.exe
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        7⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27998.exe
        7⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
        6⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        7⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37564.exe
        7⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13012.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        7⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        7⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        6⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57165.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2044.exe
        6⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        6⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59570.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5621.exe
        6⤵
        
        PID:360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
        7⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51685.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36133.exe
        7⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18903.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37404.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31492.exe
        6⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        6⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        5⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27581.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21643.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22812.exe
        6⤵
        
        PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6490.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        5⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        5⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe
        5⤵
        
        PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48833.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36265.exe
        5⤵
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45100.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31679.exe
        6⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        6⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14146.exe
        6⤵
        
        PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24982.exe
        5⤵
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18580.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        5⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2764.exe
        5⤵
        
        PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15744.exe
      4⤵
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exe
        5⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        5⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        5⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        5⤵
        
        PID:7072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
      4⤵
      PID:1096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64789.exe
      4⤵
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
      4⤵
      PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
      4⤵
      PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
      4⤵
      PID:7496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32059.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21875.exe
        5⤵
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36932.exe
        6⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21565.exe
        6⤵
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        6⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        6⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27467.exe
        6⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        5⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        5⤵
        
        PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
      4⤵
      PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19960.exe
        5⤵
        
        PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3168.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22962.exe
        5⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        5⤵
        
        PID:7628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11499.exe
      4⤵
      PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64710.exe
      4⤵
      PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
      4⤵
      PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
      4⤵
      PID:6896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
      4⤵
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        5⤵
        
        PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8466.exe
        5⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        5⤵
        
        PID:7392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe
      4⤵
      PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
      4⤵
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
      4⤵
      PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
      4⤵
      PID:7060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
    3⤵
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5486.exe
      4⤵
      PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54307.exe
      4⤵
      PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9510.exe
      4⤵
      PID:6816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe
      4⤵
      PID:7408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41281.exe
    3⤵
    PID:2208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2029.exe
    3⤵
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9642.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44174.exe
    3⤵
    PID:6368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29812.exe
    3⤵
    PID:7208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9335.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9335.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48989.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9985.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64142.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        7⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        7⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22812.exe
        7⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47470.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        6⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        6⤵
        
        PID:7272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        5⤵
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe
        6⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44643.exe
        6⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        6⤵
        
        PID:7568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        5⤵
        
        PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10164.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7799.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58387.exe
        5⤵
        
        PID:7680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65408.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53260.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37259.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2090.exe
        6⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        6⤵
        
        PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        5⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27467.exe
        5⤵
        
        PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe
      4⤵
      PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25907.exe
        5⤵
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
        5⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        5⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        5⤵
        
        PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe
      4⤵
      PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1499.exe
      4⤵
      PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56801.exe
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
      4⤵
      PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31163.exe
      4⤵
      PID:6784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29014.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11376.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        5⤵
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19960.exe
        6⤵
        
        PID:288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3168.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22962.exe
        6⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51049.exe
        5⤵
        
        PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58845.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        5⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
        5⤵
        
        PID:7644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13742.exe
      4⤵
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        5⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe
        5⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27467.exe
        5⤵
        
        PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe
      4⤵
      PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
      4⤵
      PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
      4⤵
      PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
      4⤵
      PID:6840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
      4⤵
      PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
      4⤵
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
      4⤵
      PID:7612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40935.exe
    3⤵
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44573.exe
      4⤵
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        5⤵
        
        PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41166.exe
      4⤵
      PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
      4⤵
      PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
      4⤵
      PID:6872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
    3⤵
    PID:2624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50501.exe
    3⤵
    PID:3576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8329.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
    3⤵
    PID:5792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53347.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53347.exe
    3⤵
    PID:7196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65060.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65060.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28460.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17983.exe
      4⤵
      Executes dropped EXE
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4993.exe
        5⤵
        
        PID:776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        5⤵
        
        PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        5⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        5⤵
        
        PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
      4⤵
      PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50677.exe
      4⤵
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
      4⤵
      PID:6948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30134.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27853.exe
      4⤵
      PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56101.exe
      4⤵
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
      4⤵
      PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
      4⤵
      PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
      4⤵
      PID:7108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1499.exe
    3⤵
    PID:3400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56801.exe
    3⤵
    PID:5000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
    3⤵
    PID:5420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
    3⤵
    PID:7464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27697.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27697.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21164.exe
      4⤵
      PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35983.exe
        5⤵
        
        PID:6520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
      4⤵
      PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
      4⤵
      PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
      4⤵
      PID:6740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47470.exe
    3⤵
    PID:3844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
    3⤵
    PID:4308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
    3⤵
    PID:6100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4902.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4902.exe
    3⤵
    PID:6756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47363.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47363.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60468.exe
    3⤵
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22812.exe
      4⤵
      PID:7488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
    3⤵
    PID:3484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43853.exe
    3⤵
    PID:4420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
    3⤵
    PID:2544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
    3⤵
    PID:5776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
    3⤵
    PID:7052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7719.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7719.exe
  2⤵
  PID:1576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3573.exe
    3⤵
    PID:6172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
    3⤵
    PID:6688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
  2⤵
  PID:3528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
  2⤵
  PID:4680
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
  2⤵
  PID:5628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16439.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16439.exe
  2⤵
  PID:5936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49629.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49629.exe
  2⤵
  PID:6856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe

Filesize
468KB

MD5
d4edef63e01ef207f7cf5391aac34eb0

SHA1
ad81cc7f11410e397e48fd19ad562b653650b601

SHA256
4df4b7118df90041046043f12139f301f63d57fff4f7184ec7bd79efd84f0baf

SHA512
6aa2ee9c74dac21d761d4c1e7722efcebf4e5b6eacbf3a0861fa2ed1fad407434360c12101f82931a614e17d3cccf9e9f49563e2557cd6b5960aded2c7a82c54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48989.exe

Filesize
468KB

MD5
c3b0e6d7eda094ea1037f88ff296ae5d

SHA1
dcc02dcf497c25fe9ec93c7c1b9ff102a5f03923

SHA256
2a58eb796a6acfd70ab4c54f96354297cd6d57b61a7dfc695ab681b2152c7794

SHA512
a3928e093e099f4420a597b85f45c4fe858afe1a39e89d27676b81d87f58b1d94414a2609fbc5fe7725096736e8461c97200503bf254a67405a6b5347adf7f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5813.exe

Filesize
468KB

MD5
6d5a1c8aba8ca4b83c49d7fd9ab11f35

SHA1
d4b796d1155cc56613c011bea512b44a398b26ab

SHA256
4bb938530f99b9efa3818cec945acd2db7abdd654823a198ab2639ac71fac976

SHA512
3b42a0636e822d8e8e664926600d3e1cceaaf84b6daa22b7b811bef45d033c7590353a0eea6dfa72bf0fe78c1befc1949435d1ed209395b873bdb8be692192a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59195.exe

Filesize
468KB

MD5
ae8d4ca59a16ebeb0d8367f9abcf15a7

SHA1
3824cb98a18cb885d7c647d04e7ba21974f14504

SHA256
bd6da82a58fb16cc88f173e846ab5d2877dbea28abfcfcd7ed801c4d41cfb721

SHA512
14fb9ef44c1b5a4e422d3b3ef2135a24419b8dedbad00f53d15a425f85f039869d69a0cef0baf9a6a7e67588d9f5725ba8947db8f98fbb08eb696167526137a5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe

Filesize
468KB

MD5
b6d6378412e0255ad1563f5d1fbdede7

SHA1
1c2cc1e90c6fd4d0ec070b849fc3c2da7f01ef3e

SHA256
6bc1fbf45c61b23c3d61ed69ba95e72cd6c13f19a808fb6dd9ce12a7d4c8fa18

SHA512
f09b86230f947aae8e77b9c15bfbb286245214ce3a4f69e6cc207bfb2109b11278a181b361b90a7cc6f44f469e9b543fd6bf22f713bade7e9b80c5c5c2820086

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32059.exe

Filesize
468KB

MD5
9fd5adb9d6e8971b8d77bd901c57cfca

SHA1
b1ad9350c2811bc8e154ef33300472b650ae98cf

SHA256
44b74f6a54afc7a5b9b8062c62243c819bf8bfdefc425e1492d7dc5e7c5d4b87

SHA512
3b8cf3fdc04ba145e7b46d5f736df22f6384bfbe2ea2b009997370ac3ca875f71c3c5423b22ba3cbe1f1f576300a2742b8b6f082b17078e00ab57b75c51c58a7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3213.exe

Filesize
468KB

MD5
4a92c39e5822e8ac3a80d39574d9be03

SHA1
b921d7d9383a56355b13e287511ccf747f24fa96

SHA256
e6a98a24f25bbeebf0cd1f162b2a598386b0e1ba5353b5ad212dcd61b59c1355

SHA512
246b3b772ad289a556711ebd9ff6994d97bbf6bd18e6494065dc7bede3eadfb8073156c0615676225e7b29cf470e409d176051e12239a1c4dbe8f341cb0f9c7f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3379.exe

Filesize
468KB

MD5
3649fc6fd19040c1fbb16e0dff8ddeeb

SHA1
6fb80fad5a6ff0ac409785b06130bdb35478f9c3

SHA256
952a12e5b51be0b456a25985eb78f2d92bf5de580c7ffef8720f45f9f24a108f

SHA512
0dece74b9750ada3baef05ba10c0029dbb069749ff6988b8c4fc17966d193b9535f56b2faf6e544b9a451b90a340788f0c6191730b67b30a90728840313c213e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38024.exe

Filesize
468KB

MD5
3672a681d0e047de0f26ec6708a81776

SHA1
d3f19f942f2e715c5b24fc0119d0fd0a2069c7ab

SHA256
7f74f5c457ab2f3edb5030341d1962b9eb18fab3400ef3472bd6bd3de0ba5947

SHA512
a7f54e9d2b851009c1a4632326fe74ff642f5798ed35c24ae148d1235e0aa97f75fec4239331d41f3813a339df63fe9e119ec6237889ffbdacef399279712a0f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4702.exe

Filesize
468KB

MD5
979163feab8c255354a5f4131138505a

SHA1
53b836622d68a5ee2a9041f71a432ee8fb9fb416

SHA256
4d6270c74b882657a5edf138ccad946f4de1ce568fbb23637ee5b19f77923b92

SHA512
032e3bb50b2e8da1dd275e93b6973d4836e47ac05a33c650e52c38ad432ae2868287383fe2d369325b8a6b20d6e83e5b2c21b0b4d4a931b7e3115f5ad20759c5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe

Filesize
468KB

MD5
ea1d3ecb2ec3966632d954b4a405c298

SHA1
f9c6d7fa5a447cf5f94537d20f6b25bf0fed2094

SHA256
9cd7b789f6a56d1f497cc92822abb5ffa122d7ebc0079a158e6471c9462f7a7b

SHA512
4d9cf6ebb81a1f4c04b98cbc472fbbe8a62c432aefb81fdda5972ebcce724800bf12eb19a2e163540de5791c376a6d25768f36ade00e1315b5533a324520c214

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47598.exe

Filesize
468KB

MD5
840df1a43890fe7008fdb229e891efde

SHA1
180851262ac7ef0189ded534a0c5eee37ae34ac2

SHA256
06b14b1f56807f05d9ae913d31a6a71b82fafe7efaf86c66b173075e4ae33d14

SHA512
9cadd5da604eaf3e1245e9e1d65aa74f8d149c5e8a836befd8ba954e56175f0a3100d43918c3b03b0c7f733a9b8d2686277a18645d7b514968efc8fb2ff88182

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48885.exe

Filesize
468KB

MD5
efbca3c491bb6afb4de5a6063878d1c4

SHA1
6fede0229f572ebff753bbdbe68e189bba54f3f7

SHA256
0b79f5c938f5a545d1c82084e71038ea60edd5c7c5526e0baebe8bbad31e8559

SHA512
5b0bd6e20cfb1b8fac88b18bfa6383b9aee55abfc12688a7c0d29671c2a72f6d7a3a1fcd2d139066b36e44546ad2a561699226672ec57be70244fa417908933b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe

Filesize
468KB

MD5
7106aa925ad7a2748fa97a52eb28f842

SHA1
22b9a5f803349c5f3ca11ffc00d5c7f7deb3b0f2

SHA256
6ef40643997bc81fb1b602c9d813c6be0c658e713786efea5c288a983f260115

SHA512
66ee59a904ab362123ddaf804eeb3f77686d05fe992c0816408580195f6172906f44eb94382328732c9e9c10b882709e260d4c842734c8f48c689c9392ae681e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55299.exe

Filesize
468KB

MD5
dceb4e01a977cd13861065a9e1fb44b4

SHA1
b056b1eba36cb1b6ca31b1b657d5231222c73146

SHA256
3aa06f5dc87f68fb9605d79ae0d6d8736bf24d901ea89c2336699ab6135c5158

SHA512
ff3bb6c7d7df2b53cbd1b17cac176d2283651d6c21b8e75f85560214eb935a5637e966db93bd1f59284279511c3720fb5002e79ef86f7d91ae1e248107f0468f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58039.exe

Filesize
468KB

MD5
78e368d36aa669dbeae105babb7731c1

SHA1
e44cc77297b46a6755d3e48eabacb5e8cea1e2dd

SHA256
70ec3dd6868cc156e21bd01c6a5649e16677e3db8179b72f91b31127b3d5b89f

SHA512
f7e81611e10f88ae3718f15aab7312ec519e3671fce2f404a46c03fad9d8d1c78ad94c3ae4e96f007c6d11aea00515b5ca0ab436198b8ae43a9b1f3b9ee44af7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe

Filesize
468KB

MD5
3a7eddef5c9d9c629a5661cde7799c5e

SHA1
5cf6ef495add828999298ce77d2f9fdec0b7c996

SHA256
66f5368137d2c2effd3e1b19a3306da536a2ea51ff6faeb2b28af095b9af1501

SHA512
3913858de818eac988d80768ec5ecd7ff255fbf6e8ad0b2ed522fae4517ab501625aca5ee1ff6046b238f70520f75f7a75d15a0fa7b32295b0b8a5bf63a2d575

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65060.exe

Filesize
468KB

MD5
81281621a283c2e8bfbb9e29e7fd9fc0

SHA1
cb35ee013b8ac1559faae5a9150ae02797ec8a01

SHA256
cb6c4f75e02b43d82be6d4ee1bc70bd1664d3479bd5c111ed30cd404292d4d27

SHA512
527fe515493182c2dec88c92ed4dfc08f01905e9cb26c4774f5a73ba723b12d9cdd0df660ce11493656e0b21e503e562eef0a627baf701776312360df8510e78

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9335.exe

Filesize
468KB

MD5
a84f47becd641e21627ac972543738ff

SHA1
63480bf487165b05c9bc22585ecfa31f5560661f

SHA256
ec31c1555f12541d63bef5d6e866a701da8ad7c167fabe95bd404f4677713f6a

SHA512
f373f688b6726863dcadf21d23f1895a54a10c9f5b59ba7b75fdc6e7f0fe6beeb729a085474e31a6c3bd79ad8aef6730ab8745f9dfedecb8770f3babe0a02d40

Download Submit
memory/316-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/588-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/864-389-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/864-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/928-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1068-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1140-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1140-214-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1140-213-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1140-381-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1228-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1400-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1724-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1752-279-0x0000000002530000-0x00000000025A5000-memory.dmp

Filesize
468KB

Download
memory/1752-276-0x0000000002530000-0x00000000025A5000-memory.dmp

Filesize
468KB

Download
memory/1752-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1760-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1760-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1920-161-0x0000000002020000-0x0000000002095000-memory.dmp

Filesize
468KB

Download
memory/1920-167-0x0000000002020000-0x0000000002095000-memory.dmp

Filesize
468KB

Download
memory/1920-354-0x0000000002020000-0x0000000002095000-memory.dmp

Filesize
468KB

Download
memory/1920-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1920-23-0x0000000002020000-0x0000000002095000-memory.dmp

Filesize
468KB

Download
memory/1920-24-0x0000000002020000-0x0000000002095000-memory.dmp

Filesize
468KB

Download
memory/1920-324-0x0000000002020000-0x0000000002095000-memory.dmp

Filesize
468KB

Download
memory/1944-370-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1944-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-296-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2012-295-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2240-359-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2240-189-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2240-190-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2240-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-358-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2312-203-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2328-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-166-0x0000000003350000-0x00000000033C5000-memory.dmp

Filesize
468KB

Download
memory/2360-34-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2360-380-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2360-154-0x0000000003350000-0x00000000033C5000-memory.dmp

Filesize
468KB

Download
memory/2360-33-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2360-343-0x0000000003350000-0x00000000033C5000-memory.dmp

Filesize
468KB

Download
memory/2360-6-0x0000000003350000-0x00000000033C5000-memory.dmp

Filesize
468KB

Download
memory/2360-294-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2360-288-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2360-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-83-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/2552-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2644-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2644-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2644-230-0x00000000026C0000-0x0000000002735000-memory.dmp

Filesize
468KB

Download
memory/2644-220-0x00000000026C0000-0x0000000002735000-memory.dmp

Filesize
468KB

Download
memory/2660-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-237-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2748-238-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2756-313-0x0000000001C90000-0x0000000001D05000-memory.dmp

Filesize
468KB

Download
memory/2756-325-0x0000000001C90000-0x0000000001D05000-memory.dmp

Filesize
468KB

Download
memory/2756-26-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2756-137-0x0000000001C90000-0x0000000001D05000-memory.dmp

Filesize
468KB

Download
memory/2756-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2756-131-0x0000000001C90000-0x0000000001D05000-memory.dmp

Filesize
468KB

Download
memory/2796-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-241-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2796-245-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2812-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-396-0x0000000003590000-0x0000000003605000-memory.dmp

Filesize
468KB

Download
memory/2836-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-64-0x0000000003590000-0x0000000003605000-memory.dmp

Filesize
468KB

Download
memory/2836-200-0x0000000003390000-0x0000000003405000-memory.dmp

Filesize
468KB

Download
memory/2836-201-0x0000000003390000-0x0000000003405000-memory.dmp

Filesize
468KB

Download
memory/2836-404-0x0000000002860000-0x00000000028D5000-memory.dmp

Filesize
468KB

Download
memory/2836-106-0x0000000003390000-0x0000000003405000-memory.dmp

Filesize
468KB

Download
memory/2840-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-326-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2904-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-323-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2908-269-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2908-270-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2908-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2936-260-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2936-261-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2936-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2936-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2992-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3048-142-0x0000000001F20000-0x0000000001F95000-memory.dmp

Filesize
468KB

Download
memory/3048-306-0x0000000001F20000-0x0000000001F95000-memory.dmp

Filesize
468KB

Download
memory/3048-147-0x0000000001F20000-0x0000000001F95000-memory.dmp

Filesize
468KB

Download
memory/3048-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3048-299-0x0000000001F20000-0x0000000001F95000-memory.dmp

Filesize
468KB

Download