8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 06:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe
Size

468KB
MD5

19273d84bdf9c8bd8d72b9fe68f81500
SHA1

ec7a786aa8df15077e153578bd0c7afb7f8d95a1
SHA256

8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423
SHA512

e2795a40dbd72d30f4a4cfe61692223c59eea93486d8084e368ae66fcf095a70f6bed9fd899e4929ab06aa262c37a715334f86e3e8a5497f38951b52dbd982a7
SSDEEP

3072:tGAwog5dP08UUbY0Pzijix8/3ChEA4pCndHeZVaK1cBgJlvNsElX:tG7om5UU3PejixTEBJ1cW7vNs

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2792	Unicorn-45090.exe
2780	Unicorn-18168.exe
2712	Unicorn-55671.exe
2808	Unicorn-29647.exe
1856	Unicorn-13886.exe
3056	Unicorn-59558.exe
2900	Unicorn-24092.exe
1648	Unicorn-8188.exe
1724	Unicorn-13704.exe
1764	Unicorn-33570.exe
1304	Unicorn-60705.exe
380	Unicorn-34175.exe
2184	Unicorn-40306.exe
536	Unicorn-31873.exe
1264	Unicorn-17888.exe
1044	Unicorn-47031.exe
2108	Unicorn-1359.exe
1640	Unicorn-9911.exe
1228	Unicorn-55583.exe
1536	Unicorn-30560.exe
2536	Unicorn-30633.exe
1512	Unicorn-30633.exe
2964	Unicorn-61297.exe
992	Unicorn-3928.exe
2268	Unicorn-52367.exe
1784	Unicorn-55167.exe
1400	Unicorn-49600.exe
1948	Unicorn-63335.exe
2788	Unicorn-40149.exe
2832	Unicorn-61463.exe
3036	Unicorn-21007.exe
2596	Unicorn-1141.exe
2748	Unicorn-60430.exe
2976	Unicorn-14758.exe
1280	Unicorn-47623.exe
2772	Unicorn-59090.exe
2608	Unicorn-60539.exe
1700	Unicorn-23036.exe
1424	Unicorn-17481.exe
2312	Unicorn-23612.exe
264	Unicorn-36418.exe
2032	Unicorn-56284.exe
1768	Unicorn-50154.exe
2280	Unicorn-14216.exe
2472	Unicorn-30480.exe
1076	Unicorn-59696.exe
936	Unicorn-14024.exe
1864	Unicorn-6167.exe
1528	Unicorn-43743.exe
856	Unicorn-9255.exe
988	Unicorn-9255.exe
1516	Unicorn-325.exe
1008	Unicorn-48366.exe
1940	Unicorn-29270.exe
3040	Unicorn-1663.exe
2740	Unicorn-16665.exe
2796	Unicorn-25675.exe
2744	Unicorn-7729.exe
2612	Unicorn-19811.exe
2588	Unicorn-23297.exe
2216	Unicorn-43163.exe
3012	Unicorn-59499.exe
1704	Unicorn-37417.exe
1628	Unicorn-64138.exe

Loads dropped DLL 64 IoCs

pid	Process
2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe
2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe
2792	Unicorn-45090.exe
2792	Unicorn-45090.exe
2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe
2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe
2780	Unicorn-18168.exe
2780	Unicorn-18168.exe
2712	Unicorn-55671.exe
2792	Unicorn-45090.exe
2712	Unicorn-55671.exe
2792	Unicorn-45090.exe
2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe
2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe
2808	Unicorn-29647.exe
2808	Unicorn-29647.exe
2780	Unicorn-18168.exe
1856	Unicorn-13886.exe
2780	Unicorn-18168.exe
1856	Unicorn-13886.exe
2712	Unicorn-55671.exe
2712	Unicorn-55671.exe
2792	Unicorn-45090.exe
2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe
2792	Unicorn-45090.exe
2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe
2900	Unicorn-24092.exe
2900	Unicorn-24092.exe
1648	Unicorn-8188.exe
1648	Unicorn-8188.exe
1764	Unicorn-33570.exe
1764	Unicorn-33570.exe
2808	Unicorn-29647.exe
2808	Unicorn-29647.exe
380	Unicorn-34175.exe
380	Unicorn-34175.exe
1856	Unicorn-13886.exe
1856	Unicorn-13886.exe
2792	Unicorn-45090.exe
2792	Unicorn-45090.exe
536	Unicorn-31873.exe
1304	Unicorn-60705.exe
536	Unicorn-31873.exe
1304	Unicorn-60705.exe
2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe
2184	Unicorn-40306.exe
2712	Unicorn-55671.exe
2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe
2712	Unicorn-55671.exe
2184	Unicorn-40306.exe
1724	Unicorn-13704.exe
1724	Unicorn-13704.exe
2780	Unicorn-18168.exe
2900	Unicorn-24092.exe
2780	Unicorn-18168.exe
2900	Unicorn-24092.exe
3056	Unicorn-59558.exe
3056	Unicorn-59558.exe
1264	Unicorn-17888.exe
1264	Unicorn-17888.exe
1640	Unicorn-9911.exe
1640	Unicorn-9911.exe
1648	Unicorn-8188.exe
1648	Unicorn-8188.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64224.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe
2792	Unicorn-45090.exe
2780	Unicorn-18168.exe
2712	Unicorn-55671.exe
2808	Unicorn-29647.exe
1856	Unicorn-13886.exe
3056	Unicorn-59558.exe
2900	Unicorn-24092.exe
1648	Unicorn-8188.exe
1764	Unicorn-33570.exe
1724	Unicorn-13704.exe
380	Unicorn-34175.exe
1304	Unicorn-60705.exe
2184	Unicorn-40306.exe
536	Unicorn-31873.exe
1264	Unicorn-17888.exe
2108	Unicorn-1359.exe
1640	Unicorn-9911.exe
1044	Unicorn-47031.exe
1228	Unicorn-55583.exe
1536	Unicorn-30560.exe
1512	Unicorn-30633.exe
2536	Unicorn-30633.exe
1400	Unicorn-49600.exe
992	Unicorn-3928.exe
1948	Unicorn-63335.exe
2268	Unicorn-52367.exe
2964	Unicorn-61297.exe
1784	Unicorn-55167.exe
2788	Unicorn-40149.exe
2832	Unicorn-61463.exe
3036	Unicorn-21007.exe
2596	Unicorn-1141.exe
2748	Unicorn-60430.exe
2976	Unicorn-14758.exe
1280	Unicorn-47623.exe
2772	Unicorn-59090.exe
1700	Unicorn-23036.exe
2608	Unicorn-60539.exe
2032	Unicorn-56284.exe
2472	Unicorn-30480.exe
936	Unicorn-14024.exe
1424	Unicorn-17481.exe
2280	Unicorn-14216.exe
2312	Unicorn-23612.exe
1076	Unicorn-59696.exe
1768	Unicorn-50154.exe
264	Unicorn-36418.exe
1864	Unicorn-6167.exe
856	Unicorn-9255.exe
1528	Unicorn-43743.exe
988	Unicorn-9255.exe
1008	Unicorn-48366.exe
1516	Unicorn-325.exe
1940	Unicorn-29270.exe
2740	Unicorn-16665.exe
2796	Unicorn-25675.exe
2744	Unicorn-7729.exe
2612	Unicorn-19811.exe
2216	Unicorn-43163.exe
3012	Unicorn-59499.exe
2588	Unicorn-23297.exe
1704	Unicorn-37417.exe
1628	Unicorn-64138.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2792	2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe	30
PID 2232 wrote to memory of 2792	2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe	30
PID 2232 wrote to memory of 2792	2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe	30
PID 2232 wrote to memory of 2792	2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe	30
PID 2792 wrote to memory of 2780	2792	Unicorn-45090.exe	31
PID 2792 wrote to memory of 2780	2792	Unicorn-45090.exe	31
PID 2792 wrote to memory of 2780	2792	Unicorn-45090.exe	31
PID 2792 wrote to memory of 2780	2792	Unicorn-45090.exe	31
PID 2232 wrote to memory of 2712	2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe	32
PID 2232 wrote to memory of 2712	2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe	32
PID 2232 wrote to memory of 2712	2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe	32
PID 2232 wrote to memory of 2712	2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe	32
PID 2780 wrote to memory of 2808	2780	Unicorn-18168.exe	33
PID 2780 wrote to memory of 2808	2780	Unicorn-18168.exe	33
PID 2780 wrote to memory of 2808	2780	Unicorn-18168.exe	33
PID 2780 wrote to memory of 2808	2780	Unicorn-18168.exe	33
PID 2712 wrote to memory of 1856	2712	Unicorn-55671.exe	34
PID 2712 wrote to memory of 1856	2712	Unicorn-55671.exe	34
PID 2712 wrote to memory of 1856	2712	Unicorn-55671.exe	34
PID 2712 wrote to memory of 1856	2712	Unicorn-55671.exe	34
PID 2792 wrote to memory of 3056	2792	Unicorn-45090.exe	35
PID 2792 wrote to memory of 3056	2792	Unicorn-45090.exe	35
PID 2792 wrote to memory of 3056	2792	Unicorn-45090.exe	35
PID 2792 wrote to memory of 3056	2792	Unicorn-45090.exe	35
PID 2232 wrote to memory of 2900	2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe	36
PID 2232 wrote to memory of 2900	2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe	36
PID 2232 wrote to memory of 2900	2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe	36
PID 2232 wrote to memory of 2900	2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe	36
PID 2808 wrote to memory of 1648	2808	Unicorn-29647.exe	37
PID 2808 wrote to memory of 1648	2808	Unicorn-29647.exe	37
PID 2808 wrote to memory of 1648	2808	Unicorn-29647.exe	37
PID 2808 wrote to memory of 1648	2808	Unicorn-29647.exe	37
PID 2780 wrote to memory of 1724	2780	Unicorn-18168.exe	38
PID 2780 wrote to memory of 1724	2780	Unicorn-18168.exe	38
PID 2780 wrote to memory of 1724	2780	Unicorn-18168.exe	38
PID 2780 wrote to memory of 1724	2780	Unicorn-18168.exe	38
PID 1856 wrote to memory of 1764	1856	Unicorn-13886.exe	39
PID 1856 wrote to memory of 1764	1856	Unicorn-13886.exe	39
PID 1856 wrote to memory of 1764	1856	Unicorn-13886.exe	39
PID 1856 wrote to memory of 1764	1856	Unicorn-13886.exe	39
PID 2712 wrote to memory of 1304	2712	Unicorn-55671.exe	40
PID 2712 wrote to memory of 1304	2712	Unicorn-55671.exe	40
PID 2712 wrote to memory of 1304	2712	Unicorn-55671.exe	40
PID 2712 wrote to memory of 1304	2712	Unicorn-55671.exe	40
PID 2232 wrote to memory of 536	2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe	42
PID 2232 wrote to memory of 536	2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe	42
PID 2232 wrote to memory of 536	2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe	42
PID 2232 wrote to memory of 536	2232	8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe	42
PID 2792 wrote to memory of 380	2792	Unicorn-45090.exe	41
PID 2792 wrote to memory of 380	2792	Unicorn-45090.exe	41
PID 2792 wrote to memory of 380	2792	Unicorn-45090.exe	41
PID 2792 wrote to memory of 380	2792	Unicorn-45090.exe	41
PID 2900 wrote to memory of 2184	2900	Unicorn-24092.exe	43
PID 2900 wrote to memory of 2184	2900	Unicorn-24092.exe	43
PID 2900 wrote to memory of 2184	2900	Unicorn-24092.exe	43
PID 2900 wrote to memory of 2184	2900	Unicorn-24092.exe	43
PID 1648 wrote to memory of 1264	1648	Unicorn-8188.exe	44
PID 1648 wrote to memory of 1264	1648	Unicorn-8188.exe	44
PID 1648 wrote to memory of 1264	1648	Unicorn-8188.exe	44
PID 1648 wrote to memory of 1264	1648	Unicorn-8188.exe	44
PID 1764 wrote to memory of 2108	1764	Unicorn-33570.exe	45
PID 1764 wrote to memory of 2108	1764	Unicorn-33570.exe	45
PID 1764 wrote to memory of 2108	1764	Unicorn-33570.exe	45
PID 1764 wrote to memory of 2108	1764	Unicorn-33570.exe	45

C:\Users\Admin\AppData\Local\Temp\8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe
"C:\Users\Admin\AppData\Local\Temp\8e085beab5654043a21c6f658d6729e0013699a529285930c7d7cf6ca0611423N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45090.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45090.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29647.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8188.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61463.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25675.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        9⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58870.exe
        9⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8966.exe
        9⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
        9⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37018.exe
        8⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
        8⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        8⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
        8⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7729.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3262.exe
        8⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49700.exe
        8⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15750.exe
        8⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11615.exe
        8⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38684.exe
        8⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-593.exe
        7⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        7⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59499.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35753.exe
        8⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
        9⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9264.exe
        9⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
        9⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
        9⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        8⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
        8⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3925.exe
        8⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33801.exe
        8⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28414.exe
        7⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62773.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42565.exe
        7⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
        7⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37417.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        7⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49038.exe
        7⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        7⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56258.exe
        7⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39271.exe
        7⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        6⤵
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        6⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6884.exe
        6⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27455.exe
        7⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        8⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29699.exe
        8⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58465.exe
        8⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63238.exe
        8⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62089.exe
        7⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30337.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14906.exe
        7⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32799.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53453.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        6⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63061.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36583.exe
        6⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17481.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39016.exe
        6⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8803.exe
        6⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42565.exe
        6⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
        6⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58295.exe
        5⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12621.exe
        6⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33609.exe
        5⤵
        
        PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13704.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3928.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53121.exe
        6⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe
        7⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8966.exe
        7⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28574.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46717.exe
        6⤵
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51792.exe
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12405.exe
        6⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9582.exe
        6⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56857.exe
        7⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31686.exe
        7⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        7⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42565.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        5⤵
        
        PID:1372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22085.exe
        6⤵
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4261.exe
        6⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49994.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6884.exe
        5⤵
        
        PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14216.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28493.exe
        6⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35722.exe
        7⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12556.exe
        7⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56258.exe
        7⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        6⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8803.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42565.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        6⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45365.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
        5⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44487.exe
        6⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3399.exe
        6⤵
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39061.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54802.exe
        6⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49600.exe
        5⤵
        
        PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        5⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6884.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6167.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
        6⤵
        
        PID:328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13389.exe
        6⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62089.exe
        5⤵
        
        PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39336.exe
        5⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63162.exe
        5⤵
        
        PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exe
      4⤵
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24446.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12216.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64224.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56489.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35167.exe
      4⤵
      PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9670.exe
      4⤵
      PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35565.exe
      4⤵
      PID:5528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59558.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
        5⤵
        Executes dropped EXE
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36189.exe
        6⤵
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1105.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55332.exe
        6⤵
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7387.exe
        5⤵
        
        PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47099.exe
        5⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56258.exe
        5⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47966.exe
        5⤵
        
        PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16665.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53163.exe
        5⤵
        
        PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        5⤵
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        5⤵
        
        PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61929.exe
      4⤵
      PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50838.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34430.exe
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9670.exe
      4⤵
      PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
      4⤵
      PID:5472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34175.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9911.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21007.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19811.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32276.exe
        7⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        8⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
        8⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5029.exe
        8⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
        7⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        7⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4242.exe
        6⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17942.exe
        7⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31686.exe
        7⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        7⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15440.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29462.exe
        6⤵
        
        PID:852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
        6⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23297.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26412.exe
        6⤵
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        7⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30172.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28574.exe
        7⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62089.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29036.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20281.exe
        5⤵
        
        PID:308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48782.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8966.exe
        6⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5029.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
        5⤵
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59717.exe
        5⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        5⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20438.exe
        5⤵
        
        PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60430.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27393.exe
        5⤵
        
        PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63435.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56258.exe
        5⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47966.exe
        5⤵
        
        PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
      4⤵
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36189.exe
        5⤵
        
        PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        5⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56258.exe
        5⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47021.exe
        5⤵
        
        PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
      4⤵
      PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22809.exe
      4⤵
      PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21563.exe
      4⤵
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53437.exe
      4⤵
      PID:6796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14024.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
        5⤵
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55774.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26327.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1705.exe
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29844.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11615.exe
        5⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53760.exe
        5⤵
        
        PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34859.exe
      4⤵
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10287.exe
      4⤵
      PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
      4⤵
      PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
      4⤵
      PID:6012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-325.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exe
      4⤵
      PID:640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9264.exe
      4⤵
      PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3373.exe
      4⤵
      PID:5796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7568.exe
    3⤵
    PID:2260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2366.exe
    3⤵
    PID:3340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12899.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4335.exe
    3⤵
    PID:5424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5749.exe
    3⤵
    PID:5888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13886.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1359.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43163.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26412.exe
        8⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38601.exe
        9⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31686.exe
        9⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47213.exe
        9⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1705.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62517.exe
        8⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11615.exe
        8⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53760.exe
        8⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15290.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        8⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48782.exe
        8⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        8⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60635.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
        7⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        7⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6884.exe
        7⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64138.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14066.exe
        7⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39717.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18081.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
        7⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5288.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10501.exe
        6⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        6⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        6⤵
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60539.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe
        6⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39717.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18081.exe
        6⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27877.exe
        6⤵
        
        PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        5⤵
        
        PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3101.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        5⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        5⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55833.exe
        5⤵
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55583.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14758.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46562.exe
        6⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10734.exe
        7⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53240.exe
        8⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31686.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        8⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26531.exe
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe
        7⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        7⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        7⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
        6⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6990.exe
        7⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe
        7⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62773.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4498.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58995.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58772.exe
        6⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20281.exe
        5⤵
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31686.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44099.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9670.exe
        5⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18077.exe
        5⤵
        
        PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47714.exe
        5⤵
        
        PID:956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31986.exe
        6⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45190.exe
        6⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39336.exe
        6⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59598.exe
        5⤵
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        5⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6416.exe
      4⤵
      PID:568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        5⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11615.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38684.exe
        5⤵
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe
      4⤵
      PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44099.exe
      4⤵
      PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33.exe
      4⤵
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32129.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
      4⤵
      PID:6772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60705.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30633.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe
        6⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
        7⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        7⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        7⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53111.exe
        6⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56406.exe
        5⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        6⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe
        6⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8966.exe
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
        6⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10287.exe
        5⤵
        
        PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2845.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
        5⤵
        
        PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39493.exe
        5⤵
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45340.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60820.exe
        6⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62773.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4239.exe
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        5⤵
        
        PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7946.exe
      4⤵
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23701.exe
        5⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        5⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
        5⤵
        
        PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49994.exe
      4⤵
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63790.exe
      4⤵
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23412.exe
      4⤵
      PID:6492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55167.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7153.exe
      4⤵
      PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27253.exe
        5⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15750.exe
        5⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52581.exe
        5⤵
        
        PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21122.exe
      4⤵
      PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31475.exe
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
      4⤵
      PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
      4⤵
      PID:6152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30480.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
      4⤵
      PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48908.exe
        5⤵
        
        PID:592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49700.exe
        5⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11563.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55641.exe
        5⤵
        
        PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52395.exe
      4⤵
      PID:408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63435.exe
      4⤵
      PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21615.exe
      4⤵
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
      4⤵
      PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36045.exe
      4⤵
      PID:6420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
    3⤵
    PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4132.exe
      4⤵
      PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
      4⤵
      PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
      4⤵
      PID:5920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
    3⤵
    PID:3228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe
    3⤵
    PID:2620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42259.exe
    3⤵
    PID:4608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exe
    3⤵
    PID:6736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24092.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24092.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40306.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9255.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3656.exe
        6⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43589.exe
        7⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15750.exe
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45117.exe
        7⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38575.exe
        7⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33811.exe
        6⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        6⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        6⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        6⤵
        
        PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48560.exe
        5⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10287.exe
        6⤵
        
        PID:624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43302.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3373.exe
        6⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3058.exe
        5⤵
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14668.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        5⤵
        
        PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        5⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62431.exe
        5⤵
        
        PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29270.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20325.exe
        5⤵
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56950.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53078.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62089.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30337.exe
        5⤵
        
        PID:708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47757.exe
        5⤵
        
        PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22362.exe
      4⤵
      PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46931.exe
        5⤵
        
        PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41321.exe
      4⤵
      PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1836.exe
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
      4⤵
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
      4⤵
      PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25926.exe
      4⤵
      PID:6832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49600.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56284.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4865.exe
        5⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        6⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3395.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38266.exe
        6⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
        5⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        5⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        5⤵
        
        PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
      4⤵
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43890.exe
        5⤵
        
        PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50574.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        5⤵
        
        PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52752.exe
      4⤵
      PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14668.exe
      4⤵
      PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
      4⤵
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
      4⤵
      PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20438.exe
      4⤵
      PID:5652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50154.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41586.exe
      4⤵
      PID:576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
      4⤵
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52397.exe
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34110.exe
      4⤵
      PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61509.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61509.exe
    3⤵
    PID:3720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
    3⤵
    PID:4100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
    3⤵
    PID:5176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31580.exe
    3⤵
    PID:6468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31873.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31873.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30633.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7153.exe
      4⤵
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe
        5⤵
        
        PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        5⤵
        
        PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe
        5⤵
        
        PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41818.exe
      4⤵
      PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
      4⤵
      PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
      4⤵
      PID:5948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
      4⤵
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60076.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        5⤵
        
        PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
        5⤵
        
        PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3763.exe
      4⤵
      PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
      4⤵
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
      4⤵
      PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14194.exe
    3⤵
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
      4⤵
      PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
      4⤵
      PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
      4⤵
      PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28574.exe
      4⤵
      PID:5872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21305.exe
    3⤵
    PID:3240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4268.exe
    3⤵
    PID:3296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
    3⤵
    PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52367.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52367.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9255.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
      4⤵
      PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20611.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16602.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46766.exe
        5⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
        5⤵
        
        PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1705.exe
      4⤵
      PID:3180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7068.exe
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
      4⤵
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44413.exe
      4⤵
      PID:6484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
    3⤵
    PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11278.exe
      4⤵
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6990.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
      4⤵
      PID:6244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58659.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
    3⤵
    PID:2904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
    3⤵
    PID:5284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
    3⤵
    PID:6460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48366.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48366.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe
    3⤵
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16858.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60565.exe
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55332.exe
      4⤵
      PID:6060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42565.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42565.exe
    3⤵
    PID:4348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
    3⤵
    PID:4908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
    3⤵
    PID:6168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe
  2⤵
  PID:2432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38972.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38972.exe
  2⤵
  PID:4044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7564.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7564.exe
  2⤵
  PID:4264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8535.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8535.exe
  2⤵
  PID:4232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45997.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45997.exe
  2⤵
  PID:6980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13704.exe

Filesize
468KB

MD5
f3134b979de0cb3ee810655f83944290

SHA1
50beeb046a948a89435b369a7c988b3d424cfef1

SHA256
7d2402973c99c793aa9dc967119d49b1e169e4fac952ae45fdfd0a4001517684

SHA512
4387567114ca29540b69e8bde18e7b59bfdfad63de547b8afc3c693e39e80e06dad82352004d4b538f499693acf2e8d230f0f0c8fa312589d2ff4aed03f2c309

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13886.exe

Filesize
468KB

MD5
6d9645ef905d0da032d13d5d513f999b

SHA1
126d4799fbaaf9488e0bda1e0de17f0fe4c74cef

SHA256
1a5b3817ec5939b2c81c6a6193603611ddc8b3667bdbcd8faab9c0d28543f1b0

SHA512
7351b627b93383b3112913e3f8097cb8214ff753d2439cdc965bf1ce8996611575b0076ce84dc47974dd58e0174b79ecc8dc940c4073ee2aeeacf95c72f76389

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24092.exe

Filesize
468KB

MD5
99be54dbe129635aa9a93704a8037681

SHA1
906900c13e5dbc17fef6a3fbeeeed6e47a032e0c

SHA256
824545bb3a7993a1dde06917b529d110123ba2db22f44340c65c33ee5999972b

SHA512
e5ab68bf87ad87323573fba613979aaf34faf872efa0db7c16aa0748a5b83fad769a84a20d2f5a976508c1fe9213333a93d67c3e44a0346d04d40e3cde164e6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe

Filesize
468KB

MD5
6627d761858b613e2729a25105779f93

SHA1
0542635e2e1ad47da06a077cfc735fce632c269a

SHA256
98884701e88288a5a15f83ce7cc5420a7c8b83e6d23dff0dfb593fa3bbd51d1b

SHA512
d1a263183c1dee62decc41c8ca670de86fd931b732b91551e08017281fac4418aedced9ce0d4c25c729d4f94883342e241b9cb0da1c26248854aeeb3ff547afb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31873.exe

Filesize
468KB

MD5
496df8ccc090cbb948442a0a731b08be

SHA1
1994d54ace576feb0eadd70b83df53dd98a921cd

SHA256
a30705082ad0be8847013a6cdc03bf9668603dd3a7b96a5768a0cdd2730f1c52

SHA512
4120c846646542d34bbbd3bdcfce96e3c5db12fe90179c38142dd1182cc5caa98b19ff4508138b1b1642937135acaf0af510c0f1e9a51e524e258533e4c3d306

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40306.exe

Filesize
468KB

MD5
cee86118607ed0c4ec7e8bb1929b34bc

SHA1
af85bf9ee6fc63997ec48daed125911a5dfd810f

SHA256
155f55349d5183f8e80b7d3c5d6038d081333b9829fb15307801d375651ca656

SHA512
c8361cbd512ee7af3317ac42a0d3df59a341139dfc235cfb61b1d37ed7a9df61efdacd219850f47c9634a53f2be6d33f7bca332b9df82ada616bc7a8077b86a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46931.exe

Filesize
468KB

MD5
92c04462bbc6606f9c2bac80abb9e2a3

SHA1
b15c26de642424d0ae603acebe2c52b59dc487d7

SHA256
133760061e9ac69891a9a069e1cb9f9296c3363c79b48ebd3c0f7dc4c32f530a

SHA512
f99adbcc5d1aa42211ec204a3ccf01fd1de8efa518916d977c76882aaa2275d7dfe9b6a1c9a2378be7708b6ae0884edc0e8e112bbb3c700d01221f9fa5c92f2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe

Filesize
468KB

MD5
c70f5beead117dc56def045ac99665e4

SHA1
ddfc7f6daa8eb19d58624ca2e5bbd50d34f83c2b

SHA256
bbb39714db9962bd90e165a56ac9df6f8f4e2e7e4c6080eb0a9e379e4ff28365

SHA512
2006a5dce69393f020a66e2fd24e1033cf8de5833f494df306910bd7a8153264694f292398931d163d570ac8546347572b8ffb394ba4f6cb5a40ca2604af2162

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55583.exe

Filesize
468KB

MD5
50f295fd2c56495ab29ff830f1e6f29c

SHA1
ba156e21b23b84d61a703b96406107790d717141

SHA256
3f8c74aac2c6392f9f12f586b9be36c3136d44202a094cc608d46427264e889a

SHA512
006a88f329db1b50b4775dfc2a082b8c0df644f8bab15294b6013e8e2ea20592bed508568e49ec250e8a8cbe8d412f48f1b4e10d9d10b534a2eb3a15d2db10a2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1359.exe

Filesize
468KB

MD5
38af4422b56d1a8810d27ff19b560d65

SHA1
7f00d35fa8833f5ca443ca565ca0e3f9c60494bc

SHA256
8334ea87ac601941b85c9e489ace3244e2478eafb7e1b0be6075352c5faa653f

SHA512
38399d35ab55e82495da936e1225435149e3a85f9aab6f21fa9e22bd88c32c888a8b770d99c185d0a281765f566755177742a9699e78aa89b0e45954eb5b0692

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe

Filesize
468KB

MD5
9dcaad55e6c46e73da5e83b892abb694

SHA1
3a99b2b8edf3307d8619d37839359f1f7d88a9aa

SHA256
2ad122ae6d92f2d1118fff1528bc3d456e3bb7b422f6e8ed721efe72cb423299

SHA512
29917063cb9d365ccdb4cb8df1d8bc54d8248381211e40651317bc72072eb070c3adcf91142ee53a99140676ee904edc39b898bb96ecf93fa416537dc0cdf7dd

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe

Filesize
468KB

MD5
d45558fc39eb3e439ba9a8eb3937c9da

SHA1
a01d4190680c84ba1dfcdad2c9e38e45f5bf726e

SHA256
a43f26f5169e63b8532bf32d8fbc51d3ca5583b289fb5acf9b63f5f60cc673a9

SHA512
cb06229ebb36daca49da705b4cf9a6f32736240252c2b97a9d0452fc38f93b1a1421e7e8350d8d09fae59f37a747e9f1d63c0788ecb083e9537d7477f3115922

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29647.exe

Filesize
468KB

MD5
6f230bb88de846382a8f0e70dcbf5243

SHA1
f70ed707d38f89629219f6b55f4e4565cb7f492b

SHA256
c31274ada8660477d324b4080895d253034939e99afc7a2a9bdebf781d083c65

SHA512
6f99f97ac89fa75246cd31c85d1c9aa065af2b6878ea848dbb7a9e90fddcd218078cbda51ff2665369f03b2da4af292ab53511f7ee06f1f71be83d6108ecf649

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe

Filesize
468KB

MD5
bf6e8c8bf0753f8c13833c30f816d16b

SHA1
9be90c73fe6a161420f5d39df1abc2f506623311

SHA256
b6e44009a2c0df64d2dfc158f475d56f28d122037762ccfe591f87f53eed687b

SHA512
a14e533cb2264959d710185936901074e9a2bd97eb203d4531daa5f4f06c9892efd116494494081a09ca45bb32d3f896ed10ba198b027166880de133fb78fcd9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34175.exe

Filesize
468KB

MD5
41dd351d2c0fdef29806381cef307294

SHA1
95c3df03fe1d4a793d471ac770aaa5e6ad434517

SHA256
415478e74743fa55ecc8c2a3ef02a3e92cd20a6d14252707710ff1d1038f1894

SHA512
294e814a53f483b3d785d5eae6d3620d0fe3c33d6413ef0774a05e76de82e20eb4657355aa92957c98360d79bf80b27abb8ac815e46eeda9df7fa3158ae5e92f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45090.exe

Filesize
468KB

MD5
2915156d07c15d7e28723075def43443

SHA1
2e7a94868d4daec04dd0e726fc42c640841c3464

SHA256
7e82b59a750b58fac321ef11c8549aa12c80c0abf8bc4aecefed1b4994fdf210

SHA512
f10df5aeb0468e282f45136f78c459a99dd24b8a6ba38b7a8f9d01998cec5a0becc87f4e53c4d156de4132fc915e5cd737939e1942dad24e506be26cea801741

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe

Filesize
468KB

MD5
d129b883f71213c2be082924e81aed6d

SHA1
a76228adfa41e97fbbae5f3c8787bd61d0578701

SHA256
27d9889233baac3e7230c7c656b09ab7c8a8708a33c0d1ce9e72293f6cd87f67

SHA512
466344ccfdf38834a17582d8ac1730be72ebcd6c264354b9e98490e906fc8ca94d53af1e4f0d8b1821f287a42647417b24891415be9bfdb03c3a9718bda548a9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59558.exe

Filesize
468KB

MD5
7d4401a4c0cc4305f2a7c6871027a302

SHA1
66417a97d4cf4148e21eca0a2a704a2ba327cfac

SHA256
3d66a615dd41f2108d455a3118c97bd82af9ec6f0d6e2306bb46a3f801399354

SHA512
f2a75cc9b6e940cddd34b70e7c5129efcd05594a17383d2d3043143adb8e64d0832826f95a5b9890280e3abdc04c93c1580c3845303d799b7cfeb1a81dcc4f44

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60705.exe

Filesize
468KB

MD5
7f0dcd03999051f93d3255a595cca7db

SHA1
c447d62ed0f2ed22b9b5efc6e358af48e5102bfd

SHA256
8fb41eb9211901528397c2947f9cea227212139118babfb162446a956dcddcf3

SHA512
aa78c3502465e53643cfe7269e7ed691bf4767836bec973eff51faea7e667050e10393ef5b719273b38e290f4b2c7387c85f095f56a4e17c7dd6ff5b9ae83ef6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8188.exe

Filesize
468KB

MD5
03279d75065a45b78d9c128453f225f0

SHA1
4c5a6b5bf5240e35907384c399699acd115ed98b

SHA256
c1b0cc070afc8a864cdc2e2f74417737c16da1eb18f3aefd9feae1cfdefd2c34

SHA512
7d6aaa5d706ed6da79ea7a71df7d9299fb56036607cca3eeb12b07ff981ced51c541fad157dc7c34066e96d685a953de6820757d1b5c9ef501797dbae6f58ed5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9911.exe

Filesize
468KB

MD5
6fb56622d2ab14c1458772de3d053ffe

SHA1
3d0500a6faa63b26d2ab425cabcb28abc13aa936

SHA256
f928a6ca572f3d83b4fa33ac732505572be5b8a67f12f64c164179edf81af41e

SHA512
a80dcfad366093cee3c9ee96104e20224c98313dbb4913aff5e2f1931acde8bbcd1726981e1688d1d2fdefef175a7eaf6cfaa9c93b90c213fdcd305d593abb7c

Download Submit
memory/380-367-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/380-230-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/380-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/380-368-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/380-229-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/536-255-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/536-257-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/536-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/992-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1044-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1044-411-0x0000000001DC0000-0x0000000001E35000-memory.dmp

Filesize
468KB

Download
memory/1228-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1228-374-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/1228-375-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/1264-338-0x0000000001F40000-0x0000000001FB5000-memory.dmp

Filesize
468KB

Download
memory/1264-337-0x0000000002A70000-0x0000000002AE5000-memory.dmp

Filesize
468KB

Download
memory/1264-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1280-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1304-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1304-256-0x00000000023A0000-0x0000000002415000-memory.dmp

Filesize
468KB

Download
memory/1304-258-0x00000000023A0000-0x0000000002415000-memory.dmp

Filesize
468KB

Download
memory/1400-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1536-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1640-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1640-353-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/1640-352-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/1648-356-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/1648-189-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/1648-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1648-354-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/1724-287-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/1724-288-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/1724-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1764-210-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/1764-207-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/1764-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1764-409-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/1784-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1856-398-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/1856-66-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1856-238-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/1856-237-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/1948-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-216-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-383-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/2108-379-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/2184-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2184-267-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/2232-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-405-0x0000000001D10000-0x0000000001D85000-memory.dmp

Filesize
468KB

Download
memory/2232-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-266-0x0000000001D10000-0x0000000001D85000-memory.dmp

Filesize
468KB

Download
memory/2232-81-0x0000000001D10000-0x0000000001D85000-memory.dmp

Filesize
468KB

Download
memory/2232-10-0x0000000001D10000-0x0000000001D85000-memory.dmp

Filesize
468KB

Download
memory/2232-159-0x0000000001D10000-0x0000000001D85000-memory.dmp

Filesize
468KB

Download
memory/2232-11-0x0000000001D10000-0x0000000001D85000-memory.dmp

Filesize
468KB

Download
memory/2232-148-0x0000000001D10000-0x0000000001D85000-memory.dmp

Filesize
468KB

Download
memory/2268-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2536-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2596-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2608-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-133-0x0000000001DB0000-0x0000000001E25000-memory.dmp

Filesize
468KB

Download
memory/2712-134-0x0000000001DB0000-0x0000000001E25000-memory.dmp

Filesize
468KB

Download
memory/2712-268-0x0000000001DB0000-0x0000000001E25000-memory.dmp

Filesize
468KB

Download
memory/2712-65-0x0000000001DB0000-0x0000000001E25000-memory.dmp

Filesize
468KB

Download
memory/2712-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2772-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2780-295-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2780-47-0x0000000002810000-0x0000000002885000-memory.dmp

Filesize
468KB

Download
memory/2780-118-0x0000000002810000-0x0000000002885000-memory.dmp

Filesize
468KB

Download
memory/2780-304-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2788-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-21-0x0000000002A40000-0x0000000002AB5000-memory.dmp

Filesize
468KB

Download
memory/2792-147-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/2792-250-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/2792-251-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/2792-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-158-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/2792-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2808-209-0x0000000002790000-0x0000000002805000-memory.dmp

Filesize
468KB

Download
memory/2808-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2808-211-0x0000000002790000-0x0000000002805000-memory.dmp

Filesize
468KB

Download
memory/2808-96-0x0000000002990000-0x0000000002A05000-memory.dmp

Filesize
468KB

Download
memory/2832-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2900-173-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2900-297-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2900-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2900-174-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2900-306-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2964-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2976-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3036-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-328-0x0000000001D20000-0x0000000001D95000-memory.dmp

Filesize
468KB

Download
memory/3056-327-0x0000000001D20000-0x0000000001D95000-memory.dmp

Filesize
468KB

Download