90e5bc27f5ed08360465f4770d1765d29304b94b8d6011f316089f8f85c74139

Analysis

max time kernel
120s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 16:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f647c410549eb991250c28e9c487d450N.exe
Size

468KB
MD5

f647c410549eb991250c28e9c487d450
SHA1

7767e593742d1572e709f97ecc7f1d6b4ddd3ba6
SHA256

90e5bc27f5ed08360465f4770d1765d29304b94b8d6011f316089f8f85c74139
SHA512

ce76de77d30d31422de34ceb0c23d35855c075c2c1d51263645692345c3f8bc2db934f719d8fc490d60e8b4519775d3341486d4ca4a757a013712acbe5192918
SSDEEP

3072:3+mnogBCj28U2byGP7s/qf8/oDhjyIpl8mHBiTHf86U9IT4NivlG:3+WoFXU2vPg/qfk0DA86wK4Ni

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1644	Unicorn-12753.exe
1832	Unicorn-35634.exe
384	Unicorn-33173.exe
1960	Unicorn-55535.exe
344	Unicorn-30516.exe
4940	Unicorn-59510.exe
4092	Unicorn-8263.exe
3660	Unicorn-29298.exe
3580	Unicorn-25768.exe
972	Unicorn-1010.exe
2224	Unicorn-63432.exe
2160	Unicorn-13262.exe
4368	Unicorn-4025.exe
452	Unicorn-7844.exe
3308	Unicorn-53781.exe
1988	Unicorn-52193.exe
3908	Unicorn-10605.exe
4624	Unicorn-58720.exe
1160	Unicorn-44430.exe
3488	Unicorn-53345.exe
3208	Unicorn-32370.exe
1324	Unicorn-43645.exe
2924	Unicorn-44622.exe
3508	Unicorn-44622.exe
2548	Unicorn-52214.exe
4216	Unicorn-44622.exe
116	Unicorn-60117.exe
2016	Unicorn-52769.exe
2884	Unicorn-62006.exe
2228	Unicorn-7404.exe
3200	Unicorn-49858.exe
3196	Unicorn-61024.exe
2572	Unicorn-9785.exe
4256	Unicorn-63625.exe
3928	Unicorn-51887.exe
4484	Unicorn-54829.exe
1768	Unicorn-51010.exe
232	Unicorn-52250.exe
4000	Unicorn-34290.exe
2092	Unicorn-34290.exe
2848	Unicorn-15348.exe
3156	Unicorn-45612.exe
1828	Unicorn-23154.exe
1508	Unicorn-17532.exe
4928	Unicorn-60595.exe
1344	Unicorn-63345.exe
3416	Unicorn-6241.exe
3688	Unicorn-6241.exe
4296	Unicorn-2157.exe
2524	Unicorn-16639.exe
4616	Unicorn-22770.exe
1156	Unicorn-51913.exe
3344	Unicorn-35022.exe
5088	Unicorn-35022.exe
3492	Unicorn-35219.exe
2488	Unicorn-24284.exe
2356	Unicorn-38020.exe
1340	Unicorn-36536.exe
1648	Unicorn-44705.exe
912	Unicorn-29651.exe
1856	Unicorn-24498.exe
4692	Unicorn-45665.exe
1468	Unicorn-40761.exe
736	Unicorn-41026.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
8164	1336	WerFault.exe	153
8552	4256	WerFault.exe	120
8532	5700	WerFault.exe
9568	5716	WerFault.exe	209
11232	5724	WerFault.exe	210
9492	5732	WerFault.exe	211
11096	4224	WerFault.exe	218
14100	7000	WerFault.exe	273
16156	6960	WerFault.exe	271

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26595.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15100	dwm.exe
Token: SeChangeNotifyPrivilege	15100	dwm.exe
Token: 33	15100	dwm.exe
Token: SeIncBasePriorityPrivilege	15100	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4524	f647c410549eb991250c28e9c487d450N.exe
1644	Unicorn-12753.exe
1832	Unicorn-35634.exe
384	Unicorn-33173.exe
1960	Unicorn-55535.exe
344	Unicorn-30516.exe
4940	Unicorn-59510.exe
4092	Unicorn-8263.exe
3660	Unicorn-29298.exe
3580	Unicorn-25768.exe
972	Unicorn-1010.exe
2224	Unicorn-63432.exe
2160	Unicorn-13262.exe
4368	Unicorn-4025.exe
452	Unicorn-7844.exe
3308	Unicorn-53781.exe
1988	Unicorn-52193.exe
3908	Unicorn-10605.exe
4624	Unicorn-58720.exe
1160	Unicorn-44430.exe
3488	Unicorn-53345.exe
3208	Unicorn-32370.exe
1324	Unicorn-43645.exe
2228	Unicorn-7404.exe
2016	Unicorn-52769.exe
3508	Unicorn-44622.exe
2548	Unicorn-52214.exe
116	Unicorn-60117.exe
2884	Unicorn-62006.exe
2924	Unicorn-44622.exe
4216	Unicorn-44622.exe
3200	Unicorn-49858.exe
3196	Unicorn-61024.exe
2572	Unicorn-9785.exe
4256	Unicorn-63625.exe
3928	Unicorn-51887.exe
4484	Unicorn-54829.exe
1768	Unicorn-51010.exe
232	Unicorn-52250.exe
4000	Unicorn-34290.exe
2092	Unicorn-34290.exe
2848	Unicorn-15348.exe
3156	Unicorn-45612.exe
1828	Unicorn-23154.exe
1508	Unicorn-17532.exe
4928	Unicorn-60595.exe
3416	Unicorn-6241.exe
1156	Unicorn-51913.exe
2524	Unicorn-16639.exe
3344	Unicorn-35022.exe
1344	Unicorn-63345.exe
5088	Unicorn-35022.exe
4296	Unicorn-2157.exe
4616	Unicorn-22770.exe
3688	Unicorn-6241.exe
3492	Unicorn-35219.exe
1340	Unicorn-36536.exe
2356	Unicorn-38020.exe
2488	Unicorn-24284.exe
1648	Unicorn-44705.exe
1856	Unicorn-24498.exe
4692	Unicorn-45665.exe
736	Unicorn-41026.exe
1468	Unicorn-40761.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 1644	4524	f647c410549eb991250c28e9c487d450N.exe	87
PID 4524 wrote to memory of 1644	4524	f647c410549eb991250c28e9c487d450N.exe	87
PID 4524 wrote to memory of 1644	4524	f647c410549eb991250c28e9c487d450N.exe	87
PID 1644 wrote to memory of 1832	1644	Unicorn-12753.exe	88
PID 1644 wrote to memory of 1832	1644	Unicorn-12753.exe	88
PID 1644 wrote to memory of 1832	1644	Unicorn-12753.exe	88
PID 4524 wrote to memory of 384	4524	f647c410549eb991250c28e9c487d450N.exe	89
PID 4524 wrote to memory of 384	4524	f647c410549eb991250c28e9c487d450N.exe	89
PID 4524 wrote to memory of 384	4524	f647c410549eb991250c28e9c487d450N.exe	89
PID 1832 wrote to memory of 1960	1832	Unicorn-35634.exe	90
PID 1832 wrote to memory of 1960	1832	Unicorn-35634.exe	90
PID 1832 wrote to memory of 1960	1832	Unicorn-35634.exe	90
PID 1644 wrote to memory of 344	1644	Unicorn-12753.exe	91
PID 1644 wrote to memory of 344	1644	Unicorn-12753.exe	91
PID 1644 wrote to memory of 344	1644	Unicorn-12753.exe	91
PID 384 wrote to memory of 4940	384	Unicorn-33173.exe	92
PID 384 wrote to memory of 4940	384	Unicorn-33173.exe	92
PID 384 wrote to memory of 4940	384	Unicorn-33173.exe	92
PID 4524 wrote to memory of 4092	4524	f647c410549eb991250c28e9c487d450N.exe	93
PID 4524 wrote to memory of 4092	4524	f647c410549eb991250c28e9c487d450N.exe	93
PID 4524 wrote to memory of 4092	4524	f647c410549eb991250c28e9c487d450N.exe	93
PID 1960 wrote to memory of 3660	1960	Unicorn-55535.exe	94
PID 1960 wrote to memory of 3660	1960	Unicorn-55535.exe	94
PID 1960 wrote to memory of 3660	1960	Unicorn-55535.exe	94
PID 1832 wrote to memory of 3580	1832	Unicorn-35634.exe	95
PID 1832 wrote to memory of 3580	1832	Unicorn-35634.exe	95
PID 1832 wrote to memory of 3580	1832	Unicorn-35634.exe	95
PID 344 wrote to memory of 972	344	Unicorn-30516.exe	96
PID 344 wrote to memory of 972	344	Unicorn-30516.exe	96
PID 344 wrote to memory of 972	344	Unicorn-30516.exe	96
PID 1644 wrote to memory of 2224	1644	Unicorn-12753.exe	97
PID 1644 wrote to memory of 2224	1644	Unicorn-12753.exe	97
PID 1644 wrote to memory of 2224	1644	Unicorn-12753.exe	97
PID 4092 wrote to memory of 2160	4092	Unicorn-8263.exe	98
PID 4092 wrote to memory of 2160	4092	Unicorn-8263.exe	98
PID 4092 wrote to memory of 2160	4092	Unicorn-8263.exe	98
PID 4524 wrote to memory of 452	4524	f647c410549eb991250c28e9c487d450N.exe	101
PID 4524 wrote to memory of 452	4524	f647c410549eb991250c28e9c487d450N.exe	101
PID 4524 wrote to memory of 452	4524	f647c410549eb991250c28e9c487d450N.exe	101
PID 384 wrote to memory of 3308	384	Unicorn-33173.exe	100
PID 384 wrote to memory of 3308	384	Unicorn-33173.exe	100
PID 384 wrote to memory of 3308	384	Unicorn-33173.exe	100
PID 4940 wrote to memory of 4368	4940	Unicorn-59510.exe	99
PID 4940 wrote to memory of 4368	4940	Unicorn-59510.exe	99
PID 4940 wrote to memory of 4368	4940	Unicorn-59510.exe	99
PID 1960 wrote to memory of 1988	1960	Unicorn-55535.exe	102
PID 1960 wrote to memory of 1988	1960	Unicorn-55535.exe	102
PID 1960 wrote to memory of 1988	1960	Unicorn-55535.exe	102
PID 3580 wrote to memory of 3908	3580	Unicorn-25768.exe	103
PID 3580 wrote to memory of 3908	3580	Unicorn-25768.exe	103
PID 3580 wrote to memory of 3908	3580	Unicorn-25768.exe	103
PID 1832 wrote to memory of 4624	1832	Unicorn-35634.exe	104
PID 1832 wrote to memory of 4624	1832	Unicorn-35634.exe	104
PID 1832 wrote to memory of 4624	1832	Unicorn-35634.exe	104
PID 972 wrote to memory of 1160	972	Unicorn-1010.exe	105
PID 972 wrote to memory of 1160	972	Unicorn-1010.exe	105
PID 972 wrote to memory of 1160	972	Unicorn-1010.exe	105
PID 344 wrote to memory of 3488	344	Unicorn-30516.exe	106
PID 344 wrote to memory of 3488	344	Unicorn-30516.exe	106
PID 344 wrote to memory of 3488	344	Unicorn-30516.exe	106
PID 3308 wrote to memory of 3208	3308	Unicorn-53781.exe	107
PID 3308 wrote to memory of 3208	3308	Unicorn-53781.exe	107
PID 3308 wrote to memory of 3208	3308	Unicorn-53781.exe	107
PID 384 wrote to memory of 1324	384	Unicorn-33173.exe	108

C:\Users\Admin\AppData\Local\Temp\f647c410549eb991250c28e9c487d450N.exe
"C:\Users\Admin\AppData\Local\Temp\f647c410549eb991250c28e9c487d450N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12753.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12753.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55535.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29298.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52193.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49858.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29651.exe
        7⤵
        Executes dropped EXE
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        7⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        8⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52046.exe
        9⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2299.exe
        9⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36565.exe
        8⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
        8⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55765.exe
        8⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
        7⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51370.exe
        8⤵
        
        PID:10404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        7⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
        7⤵
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55471.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        9⤵
        
        PID:12744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17803.exe
        9⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
        8⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        8⤵
        
        PID:14856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41365.exe
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1288.exe
        7⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40252.exe
        7⤵
        
        PID:16232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18315.exe
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43966.exe
        7⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34982.exe
        8⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe
        7⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
        7⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55953.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13043.exe
        6⤵
        
        PID:11416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23716.exe
        6⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24498.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34586.exe
        7⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        8⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50287.exe
        9⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
        9⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        8⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
        8⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe
        8⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41365.exe
        7⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55454.exe
        8⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38044.exe
        7⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        7⤵
        
        PID:14768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        6⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        7⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19862.exe
        8⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        8⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-571.exe
        7⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        7⤵
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55101.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54076.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23716.exe
        6⤵
        
        PID:16192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        6⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31766.exe
        7⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5724 -s 736
        7⤵
        Program crash
        
        PID:11232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10120.exe
        6⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13347.exe
        6⤵
        
        PID:11708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47957.exe
        6⤵
        
        PID:15376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        5⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39166.exe
        6⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47838.exe
        7⤵
        
        PID:15644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10748.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60929.exe
        6⤵
        
        PID:14908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        5⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        6⤵
        
        PID:11908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3961.exe
        6⤵
        
        PID:15244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
        5⤵
        
        PID:11588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        5⤵
        
        PID:15316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25768.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9785.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        8⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9173.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32756.exe
        9⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
        9⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe
        8⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60385.exe
        9⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61256.exe
        9⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12475.exe
        8⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4460.exe
        8⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34969.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65533.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33923.exe
        8⤵
        
        PID:15252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50088.exe
        7⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21708.exe
        7⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40252.exe
        7⤵
        
        PID:16212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4248.exe
        6⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33294.exe
        8⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38926.exe
        9⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 724
        8⤵
        Program crash
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61978.exe
        7⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6441.exe
        7⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40252.exe
        7⤵
        
        PID:16284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18315.exe
        6⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
        7⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        8⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        8⤵
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
        7⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        7⤵
        
        PID:14096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28185.exe
        6⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61009.exe
        6⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
        6⤵
        
        PID:14836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63625.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61939.exe
        6⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28058.exe
        8⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        9⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6960 -s 636
        9⤵
        Program crash
        
        PID:16156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5700 -s 636
        8⤵
        Program crash
        
        PID:8532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 644
        7⤵
        Program crash
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25685.exe
        6⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29026.exe
        7⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 724
        7⤵
        Program crash
        
        PID:11096
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 752
        6⤵
        Program crash
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17983.exe
        5⤵
        
        PID:1372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33491.exe
        6⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        7⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57075.exe
        8⤵
        
        PID:15696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
        7⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        7⤵
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41365.exe
        6⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38044.exe
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        6⤵
        
        PID:14972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61285.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61999.exe
        6⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60690.exe
        7⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        6⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62128.exe
        6⤵
        
        PID:15660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47288.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62045.exe
        5⤵
        
        PID:11472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exe
        5⤵
        
        PID:16264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58720.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
        6⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27490.exe
        8⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5732 -s 608
        8⤵
        Program crash
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        7⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14613.exe
        8⤵
        
        PID:16492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1480.exe
        7⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51568.exe
        7⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exe
        6⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40510.exe
        7⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48438.exe
        8⤵
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        7⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
        7⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50088.exe
        6⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43936.exe
        6⤵
        
        PID:13048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        5⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25178.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64246.exe
        7⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
        8⤵
        
        PID:13800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29461.exe
        7⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33923.exe
        7⤵
        
        PID:13736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11292.exe
        6⤵
        
        PID:11896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        6⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8907.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54511.exe
        6⤵
        
        PID:8984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        6⤵
        
        PID:12728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4783.exe
        6⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
        5⤵
        
        PID:9052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        5⤵
        
        PID:13472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51945.exe
        5⤵
        
        PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54829.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23080.exe
        5⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7637.exe
        6⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27646.exe
        7⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        7⤵
        
        PID:14824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
        6⤵
        
        PID:9964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        6⤵
        
        PID:15268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3811.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        5⤵
        
        PID:10500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27319.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38296.exe
        5⤵
        
        PID:7800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
      4⤵
      PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24602.exe
        5⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61231.exe
        6⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51922.exe
        7⤵
        
        PID:15728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33923.exe
        6⤵
        
        PID:13428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5652.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31904.exe
        5⤵
        
        PID:11952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        5⤵
        
        PID:14964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
      4⤵
      PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22498.exe
        5⤵
        
        PID:8356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17780.exe
        5⤵
        
        PID:12304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1275.exe
        5⤵
        
        PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1954.exe
      4⤵
      PID:9072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40387.exe
      4⤵
      PID:12404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30516.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1010.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44430.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51010.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32474.exe
        7⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3449.exe
        8⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10385.exe
        9⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2388.exe
        9⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60929.exe
        9⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        8⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1522.exe
        9⤵
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13347.exe
        8⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47305.exe
        7⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
        8⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6680.exe
        8⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49900.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4516.exe
        7⤵
        
        PID:11500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33988.exe
        6⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1633.exe
        7⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24278.exe
        8⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41400.exe
        8⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        7⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9944.exe
        7⤵
        
        PID:13324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
        6⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60385.exe
        7⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13125.exe
        7⤵
        
        PID:14004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58456.exe
        6⤵
        
        PID:13168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52250.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40642.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59194.exe
        7⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23162.exe
        8⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34261.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        8⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22777.exe
        7⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        7⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10648.exe
        7⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41632.exe
        6⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45274.exe
        7⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
        7⤵
        
        PID:12252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1584.exe
        6⤵
        
        PID:12900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6883.exe
        5⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60818.exe
        6⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59059.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20473.exe
        8⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
        8⤵
        
        PID:15088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
        7⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2217.exe
        7⤵
        
        PID:13952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36212.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64945.exe
        7⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63809.exe
        6⤵
        
        PID:9648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        6⤵
        
        PID:14844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe
        5⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56414.exe
        6⤵
        
        PID:16700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7947.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44852.exe
        5⤵
        
        PID:11524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34290.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21182.exe
        6⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe
        7⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22031.exe
        8⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        8⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17227.exe
        8⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41064.exe
        7⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exe
        7⤵
        
        PID:12768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59941.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37106.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17803.exe
        7⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36513.exe
        6⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4516.exe
        6⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10343.exe
        6⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43417.exe
        5⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14077.exe
        6⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9944.exe
        6⤵
        
        PID:13408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6451.exe
        6⤵
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10251.exe
        5⤵
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62732.exe
        5⤵
        
        PID:13368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45612.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42863.exe
        5⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24602.exe
        6⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36883.exe
        8⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        8⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
        7⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2217.exe
        7⤵
        
        PID:13892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40488.exe
        6⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63809.exe
        6⤵
        
        PID:9568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        6⤵
        
        PID:15156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60709.exe
        5⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        6⤵
        
        PID:8580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44698.exe
        6⤵
        
        PID:13520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25779.exe
        6⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
      4⤵
      PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
        5⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51797.exe
        6⤵
        
        PID:13336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
        6⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9944.exe
        5⤵
        
        PID:13820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        5⤵
        
        PID:15544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60544.exe
      4⤵
      PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58869.exe
      4⤵
      PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14589.exe
        5⤵
        
        PID:14808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46734.exe
      4⤵
      PID:10940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63240.exe
      4⤵
      PID:4696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63432.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35022.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        6⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15806.exe
        7⤵
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
        8⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        8⤵
        
        PID:13508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60769.exe
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5724.exe
        7⤵
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
        7⤵
        
        PID:16428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
        6⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
        7⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47521.exe
        7⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49900.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2143.exe
        6⤵
        
        PID:9708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46566.exe
        6⤵
        
        PID:13500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24659.exe
        6⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60385.exe
        7⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13125.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
        6⤵
        
        PID:9540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        6⤵
        
        PID:15264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33468.exe
        5⤵
        
        PID:7728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3924.exe
        5⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6131.exe
        5⤵
        
        PID:13968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10465.exe
        5⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18389.exe
        6⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
        7⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        7⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe
        6⤵
        
        PID:9792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31050.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1983.exe
        6⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3321.exe
        6⤵
        
        PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe
        5⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
        5⤵
        
        PID:13116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59544.exe
        5⤵
        
        PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21631.exe
      4⤵
      PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        5⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43027.exe
        6⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36164.exe
        7⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        6⤵
        
        PID:11292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25779.exe
        6⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
        5⤵
        
        PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        5⤵
        
        PID:14016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
      4⤵
      PID:8348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47680.exe
      4⤵
      PID:12112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2171.exe
      4⤵
      PID:10776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2157.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1913.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33294.exe
        6⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3321.exe
        7⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        6⤵
        
        PID:14076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36212.exe
        5⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57075.exe
        6⤵
        
        PID:15716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38044.exe
        5⤵
        
        PID:11296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        5⤵
        
        PID:15148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
      4⤵
      PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        5⤵
        
        PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        5⤵
        
        PID:9600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7779.exe
        5⤵
        
        PID:13776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
      4⤵
      PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3489.exe
        5⤵
        
        PID:15488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4137.exe
      4⤵
      PID:10836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
      4⤵
      PID:14816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35219.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10465.exe
      4⤵
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25043.exe
        5⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
        6⤵
        
        PID:9912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55881.exe
        6⤵
        
        PID:13356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25971.exe
        6⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
        5⤵
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26595.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43909.exe
      4⤵
      PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
      4⤵
      PID:14788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
    3⤵
    PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24659.exe
      4⤵
      PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
        5⤵
        
        PID:11644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        5⤵
        
        PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
      4⤵
      PID:10076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
      4⤵
      PID:15356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31199.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31199.exe
    3⤵
    PID:7696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
      4⤵
      PID:11992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16296.exe
      4⤵
      PID:15608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43879.exe
    3⤵
    PID:9828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
    3⤵
    PID:13960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33173.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33173.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4025.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        6⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
        7⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43027.exe
        8⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        8⤵
        
        PID:11408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25971.exe
        8⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46602.exe
        7⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47548.exe
        7⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22396.exe
        7⤵
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
        6⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39898.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
        7⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        6⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        6⤵
        
        PID:11496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51913.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39054.exe
        6⤵
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe
        7⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15970.exe
        8⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48969.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63509.exe
        7⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31707.exe
        7⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7716.exe
        7⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55613.exe
        6⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
        7⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        6⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
        6⤵
        
        PID:13756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62472.exe
        5⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        6⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23567.exe
        7⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
        7⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17803.exe
        7⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27328.exe
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
        6⤵
        
        PID:12800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19200.exe
        6⤵
        
        PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42349.exe
        5⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14049.exe
        6⤵
        
        PID:13804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10635.exe
        5⤵
        
        PID:9660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53981.exe
        5⤵
        
        PID:13784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        5⤵
        
        PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52769.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6241.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14741.exe
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35951.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52882.exe
        8⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34453.exe
        7⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        6⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46602.exe
        6⤵
        
        PID:10964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34240.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12857.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5006.exe
        6⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23567.exe
        7⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18506.exe
        8⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
        7⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17803.exe
        7⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exe
        6⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65532.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42273.exe
        5⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14613.exe
        6⤵
        
        PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30349.exe
        5⤵
        
        PID:9832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        5⤵
        
        PID:13264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38020.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34586.exe
        5⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
        6⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59538.exe
        7⤵
        
        PID:10408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22371.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35409.exe
        6⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
        6⤵
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30916.exe
        5⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        6⤵
        
        PID:12008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        6⤵
        
        PID:15144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42217.exe
        5⤵
        
        PID:9536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59089.exe
        5⤵
        
        PID:14012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe
      4⤵
      PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16883.exe
        5⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24500.exe
        5⤵
        
        PID:11380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42092.exe
        5⤵
        
        PID:14756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24852.exe
      4⤵
      PID:9040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61918.exe
      4⤵
      PID:12192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53781.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32370.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34290.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33434.exe
        6⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
        7⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11101.exe
        8⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        8⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        8⤵
        
        PID:16276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58081.exe
        7⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31515.exe
        7⤵
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        6⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7609.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
        6⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43417.exe
        5⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1633.exe
        6⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
        7⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57075.exe
        8⤵
        
        PID:15704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        7⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45816.exe
        7⤵
        
        PID:772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        6⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        6⤵
        
        PID:13316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39124.exe
        6⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
        5⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        6⤵
        
        PID:12000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        6⤵
        
        PID:15272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18532.exe
        5⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58456.exe
        5⤵
        
        PID:13152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15348.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33626.exe
        5⤵
        
        PID:1104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
        6⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60385.exe
        7⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49004.exe
        7⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27177.exe
        7⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        6⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
        6⤵
        
        PID:13128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39124.exe
        6⤵
        
        PID:17220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        5⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe
        6⤵
        
        PID:11836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        6⤵
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10547.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
        5⤵
        
        PID:14864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51424.exe
      4⤵
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21779.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe
        6⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
        6⤵
        
        PID:12468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        6⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25060.exe
        5⤵
        
        PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42844.exe
        5⤵
        
        PID:13204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26601.exe
        5⤵
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
      4⤵
      PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51086.exe
        5⤵
        
        PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        5⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49900.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1424.exe
      4⤵
      PID:9112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44852.exe
      4⤵
      PID:10764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60595.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41410.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49490.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61231.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50074.exe
        7⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33923.exe
        7⤵
        
        PID:15308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe
        6⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31904.exe
        6⤵
        
        PID:11960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39789.exe
        6⤵
        
        PID:15280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6656.exe
        5⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        6⤵
        
        PID:12076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        6⤵
        
        PID:14888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36513.exe
        5⤵
        
        PID:8288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59538.exe
        6⤵
        
        PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21044.exe
        5⤵
        
        PID:12552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2084.exe
      4⤵
      PID:964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39542.exe
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31718.exe
        6⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        5⤵
        
        PID:8964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9944.exe
        5⤵
        
        PID:13416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10535.exe
        5⤵
        
        PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
      4⤵
      PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        5⤵
        
        PID:15620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56550.exe
      4⤵
      PID:10192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62732.exe
      4⤵
      PID:13376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1721.exe
      4⤵
      PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57907.exe
        5⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
        6⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2299.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59849.exe
        6⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        5⤵
        
        PID:10296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35409.exe
        5⤵
        
        PID:14160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10535.exe
        5⤵
        
        PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
      4⤵
      PID:7720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63596.exe
      4⤵
      PID:9808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14796.exe
      4⤵
      PID:13996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22787.exe
      4⤵
      PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
    3⤵
    PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21426.exe
      4⤵
      PID:7204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20068.exe
      4⤵
      PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56414.exe
        5⤵
        
        PID:14432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1288.exe
      4⤵
      PID:11316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
      4⤵
      PID:16244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
    3⤵
    PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
      4⤵
      PID:10616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26773.exe
      4⤵
      PID:11880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23521.exe
    3⤵
    PID:10304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
    3⤵
    PID:12944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52214.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35022.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14741.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34882.exe
        7⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54511.exe
        8⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38926.exe
        9⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        8⤵
        
        PID:11312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
        8⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34453.exe
        7⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        7⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18380.exe
        7⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe
        6⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24278.exe
        7⤵
        
        PID:13096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
        7⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37573.exe
        6⤵
        
        PID:12840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20148.exe
        5⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        6⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        7⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40608.exe
        7⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
        6⤵
        
        PID:10172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        6⤵
        
        PID:14044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55101.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43909.exe
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        5⤵
        
        PID:14744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
        5⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51086.exe
        7⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        7⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30055.exe
        7⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50297.exe
        6⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14049.exe
        7⤵
        
        PID:13812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        6⤵
        
        PID:12720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
        6⤵
        
        PID:7272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60709.exe
        5⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34942.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17780.exe
        6⤵
        
        PID:12740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45816.exe
        6⤵
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe
        5⤵
        
        PID:11136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36632.exe
        5⤵
        
        PID:15336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
      4⤵
      PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12269.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        6⤵
        
        PID:15204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60769.exe
        5⤵
        
        PID:9712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4655.exe
        5⤵
        
        PID:14048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38950.exe
      4⤵
      PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
        5⤵
        
        PID:10896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
        5⤵
        
        PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32399.exe
      4⤵
      PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10208.exe
      4⤵
      PID:14144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62006.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6241.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26226.exe
        5⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50066.exe
        6⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4573.exe
        7⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42232.exe
        7⤵
        
        PID:14172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22777.exe
        6⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        6⤵
        
        PID:12692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15976.exe
        5⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        5⤵
        
        PID:9680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34449.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35039.exe
        5⤵
        
        PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46625.exe
      4⤵
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57907.exe
        5⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        6⤵
        
        PID:12068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        6⤵
        
        PID:14872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
        5⤵
        
        PID:10136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54081.exe
      4⤵
      PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-157.exe
        5⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe
        6⤵
        
        PID:14852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61437.exe
        6⤵
        
        PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17780.exe
        5⤵
        
        PID:12308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42308.exe
        5⤵
        
        PID:584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18340.exe
      4⤵
      PID:9888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58456.exe
      4⤵
      PID:13136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10465.exe
      4⤵
      PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28058.exe
        5⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        6⤵
        
        PID:12168
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7000 -s 624
        6⤵
        Program crash
        
        PID:14100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2056.exe
        5⤵
        
        PID:9424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31707.exe
        5⤵
        
        PID:12832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
      4⤵
      PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        5⤵
        
        PID:15012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
      4⤵
      PID:9572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
      4⤵
      PID:14796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44902.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44902.exe
    3⤵
    PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40510.exe
      4⤵
      PID:8128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
      4⤵
      PID:11572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33923.exe
      4⤵
      PID:15232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21055.exe
    3⤵
    PID:7304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59549.exe
    3⤵
    PID:11624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31654.exe
    3⤵
    PID:15324
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22770.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe
        6⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        6⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19349.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35200.exe
        5⤵
        
        PID:9176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35409.exe
        5⤵
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43208.exe
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20532.exe
      4⤵
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21107.exe
        5⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-328.exe
        5⤵
        
        PID:13140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
      4⤵
      PID:7808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41610.exe
      4⤵
      PID:13120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24284.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
      4⤵
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1825.exe
        5⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20910.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        6⤵
        
        PID:15184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22777.exe
        5⤵
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        5⤵
        
        PID:12476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
        5⤵
        
        PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19868.exe
      4⤵
      PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        5⤵
        
        PID:12100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        5⤵
        
        PID:14896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3156.exe
      4⤵
      PID:8648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1279.exe
      4⤵
      PID:9980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23548.exe
      4⤵
      PID:6136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58689.exe
    3⤵
    PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
      4⤵
      PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        5⤵
        
        PID:14988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
      4⤵
      PID:9936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
      4⤵
      PID:14056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60966.exe
    3⤵
    PID:7736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37540.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37540.exe
    3⤵
    PID:11520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exe
    3⤵
    PID:16224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7404.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7404.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23154.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe
      4⤵
      PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30414.exe
        5⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54511.exe
        6⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        6⤵
        
        PID:12736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49900.exe
        6⤵
        
        PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56026.exe
        5⤵
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        5⤵
        
        PID:12300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16936.exe
      4⤵
      PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54511.exe
        5⤵
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45816.exe
        5⤵
        
        PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50685.exe
      4⤵
      PID:10180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
      4⤵
      PID:13348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6451.exe
      4⤵
      PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17268.exe
    3⤵
    PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
      4⤵
      PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23354.exe
        5⤵
        
        PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58325.exe
        5⤵
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-867.exe
        5⤵
        
        PID:15756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34453.exe
      4⤵
      PID:8780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
      4⤵
      PID:4460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
    3⤵
    PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15934.exe
      4⤵
      PID:15200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59549.exe
    3⤵
    PID:11600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31654.exe
    3⤵
    PID:14936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-377.exe
    3⤵
    PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45214.exe
      4⤵
      PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48403.exe
        5⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55454.exe
        6⤵
        
        PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10748.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31271.exe
        5⤵
        
        PID:15344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30841.exe
      4⤵
      PID:7196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29685.exe
      4⤵
      PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe
      4⤵
      PID:14940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26480.exe
      4⤵
      PID:60
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27844.exe
    3⤵
    PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2077.exe
      4⤵
      PID:8636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
      4⤵
      PID:13844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53984.exe
      4⤵
      PID:1536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41593.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41593.exe
    3⤵
    PID:14980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12589.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12589.exe
  2⤵
  PID:1284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
    3⤵
    PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55279.exe
      4⤵
      PID:8796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
      4⤵
      PID:9440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49900.exe
      4⤵
      PID:716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41064.exe
    3⤵
    PID:9272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
    3⤵
    PID:13108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6451.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41515.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41515.exe
  2⤵
  PID:6196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55279.exe
    3⤵
    PID:3896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
    3⤵
    PID:11308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17803.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17803.exe
    3⤵
    PID:4136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40625.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40625.exe
  2⤵
  PID:9108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39252.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39252.exe
  2⤵
  PID:11492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1336 -ip 1336
1⤵
PID:6948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4256 -ip 4256
1⤵
PID:8832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5700 -ip 5700
1⤵
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5716 -ip 5716
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5724 -ip 5724
1⤵
PID:11056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5732 -ip 5732
1⤵
PID:9884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4224 -ip 4224
1⤵
PID:10304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 7000 -ip 7000
1⤵
PID:11124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 6960 -ip 6960
1⤵
PID:15412

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1010.exe

Filesize
468KB

MD5
b95a023570f57234699dc43ebb5852d7

SHA1
f5a2473cf41e2c0bb6aa7b880a99a614b75cd296

SHA256
597779cd36caf388d4c0a4d6e21361d91c33e8f51dd51a9946a8430ecaba173a

SHA512
53d3ca9ec8acaeac52890de139a1162b68ab363f5496d51a79ed10d98f7487a41d3d8e3ae04e6742df0e20bbdd5b43f2268fa126c58d93d0a945370ce32e434b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe

Filesize
468KB

MD5
cb07793e00d2b492af5c92eeaadfcb42

SHA1
cab780c7a587dd37e35cd9755522095332feb0c0

SHA256
797df11af310044e03d1f6b59fb4199e62ced84a8ae8cfbce761a35da68f2167

SHA512
fb3cee480a8124a3af46b41949b2ca2fe57cc02be6ec8ddad95b1edefdfbaa98c9dc43276f60f5c141f3c9c00c9569a4fa7a0c2cd04e2fd4868e1f47b37d814f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12753.exe

Filesize
468KB

MD5
88bbd431a7f2250af992bee8681a29c0

SHA1
61c16479001274725bcd584484db139d0a34935e

SHA256
4af948bda97a713d569c95c71074fb8e89c143b958b882ecb051edf9205436c7

SHA512
6f19f0c36de09cea8dd2c332ed45dd8a247299d909b468d2eb0ef8279ffae3993ff55f96d4c42d1b1f63dbc76e1e4efc55b5f3185feb7a5bea24405d50afaa2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe

Filesize
468KB

MD5
1079c82db4ba5c9559cb522ecbe08618

SHA1
e039f9451090120a3e0aeeeee90c2311fd0bad87

SHA256
f6f80343891b39bb3cc216b6c384aa86d116a0c72f0486146c995e52306f9546

SHA512
aa662ac99a86fd59ead47cf768d7c768c5c14dd5dfedfe35ecc93c0b3ff17438425bd7d2e575382ee324d345a4779e362abd9a1b08fd60caa19f629ecbcc9f3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24278.exe

Filesize
468KB

MD5
3b6e77b2a43d9ebb48863bb7ffd3f349

SHA1
6f2beabb17f73cbe35fb621d95a08b8ff129d63a

SHA256
6b1efdcbb6aca8312b3fb1d492f3c2514142d567a24f3d10adebd65270bd9d3f

SHA512
789f7c7162b35746cedd2d59f1f90fcfbdc34bb5e34847d169561200922503cd35889f374556a9a63576eab3fdaffc04950d0e878f3a9fb004b5d2bb346a894b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25768.exe

Filesize
468KB

MD5
dfa61ca5bed3282f6225cc54e221a2aa

SHA1
6c96c469befcc6eef18967e13b240a532ce05b7b

SHA256
7ed67250f0529e7714a0be0845682b9707ab91be6cc97b611468cbf86a127a45

SHA512
769d8e6cbc49991d01c08420dd14c90311308ef36e53e542c347f8bcdf13087beb7c2b23a0df4696f0402cb1894f195b668fefcac3d1e0f758a5ea29387cb019

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29298.exe

Filesize
468KB

MD5
076638817dedc556c80568eb9dfaf9cb

SHA1
a0f1cf18c33b07cfc10751ecd94a329544bf32a9

SHA256
80ecbb098b54d99c1bafbb5a52007d1718908bec2fb8f642a3811a99a2997349

SHA512
7b18885b2e29c9e5d2720162ca5fb37b286e06b7d28e123cc889dbca0104b282bc752428c3d2f9d1ab0d5d2a73f051365f9ff037759ea273177f3a866d5608fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30516.exe

Filesize
468KB

MD5
c627af4b3d51e8c67beb049e95f1bc6f

SHA1
c3b47f0897a90dcb4b9c06b4a2f5adc119ea42dc

SHA256
5b700e557c83d454ae6f4f84295c54b860eb125d166292caaea99fb2f95e48cd

SHA512
f75763e36047a581916e10f68e2f5687cdfe36b36047f28e0ee4519ca6ce0e75f0728c79a3123f36f2da30b61690553a95c4174cef2f5324e9e614bad6c374c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32370.exe

Filesize
468KB

MD5
9bb718a7a8b84148c94982b40df54dfb

SHA1
ba3dfc8d1ce9283acb255fccaba74bff78aa359b

SHA256
2001a27d0624e018d49035919984af7df41cdfeefe5ade998b16f33d307aa6b6

SHA512
cca06a7cac0e78e6d03164605817d407e66fda2b6cd9f9f0b57f7643f48a0a3c1727d02369ba9847cf9b0126d13b48155d51a61e23f9559e3895228ab94bfc50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33173.exe

Filesize
468KB

MD5
01723e159f8120a653de68ed8990ac04

SHA1
adc86d7b90e77635d61ff12c3c7e3e5ffcfea841

SHA256
059f76b3ec5ea760705d78082e437a764b80f42412399b8567a49da6deb57d7b

SHA512
98a282a30e60d1ed28a8d9f3bd0a1613253047d410a2e20d5275c6ec341d60b0490d6fe756615a28d578505b559655fddf5bc890ab38da89df0a4f51f113e40d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe

Filesize
468KB

MD5
f613e5512cd5f072d647f1b8691ae9b1

SHA1
caf9f8b6831af022126ab4b40c858daabbd0b496

SHA256
bd81ddb980d76f39e8958956969bb97a003cbd0451365f713dc948db024c1d2a

SHA512
2aafcf07e11c45005ecd7052f2f3f105f532e7fd8afc891291f8afa336d74b478c7f176ce0af4aa50a80121fb1512cfd5e61ac3a771a93400f1537f2537384ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4025.exe

Filesize
468KB

MD5
609a0f6dfdb119173e1b416aebae5f61

SHA1
8f7d9b8c41ee547b7dab9631c54a7a31eab904c5

SHA256
03452cd85a4aa78619b08dd61869070faf174854b91f782066ad7ce36c2eae34

SHA512
06cd1f63c75be493171b8f1ab4d698d6e2420f6eb64f1864fbe4c7e4b911dfc66311c62086429d93faa3e6748ed0123ea147884a7c25c8948531855f897c93a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe

Filesize
468KB

MD5
6765a15ee1dc1f51a0ebe8b17d160ba9

SHA1
74f89f320d528bf82bb9a5fb6129120cb0037c8d

SHA256
4ef6071ca7a7d65ea2f99095422879d875724c557afffedcf8a3a4848bd61391

SHA512
11ebd750404a4f1d3eb29072265e4459ab5e30c82a6952fa9c3b55e1a8f7b0101849e815d617110e6a9fb583a7fcbe3c51cc983b7b777a3e827dc930b87a4501

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44430.exe

Filesize
468KB

MD5
904078df2d41c685a7aac0d881bf76a6

SHA1
e7c89284ed2e1ce8ceff73189266c3577a77eafb

SHA256
875274bee7e3f7ed88722d03e59e28daa1199c1ec7bd1811191d45f309e85eb4

SHA512
dedaf37a439b3281bc0c0506ff679b97a88f2dc1106bfa0d0141d7763c2b041b8db058c94901a243c84a4842089eb9d9cb109002d64f693f2a7d3ee9e0c432e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe

Filesize
468KB

MD5
7e9fddaf02b32ed5d5c2cb421d249787

SHA1
a151be94f5216f7b8b5364c214a4063a3fd0f551

SHA256
30cf88ff54c10faee31611be2085f9b7ef7708b07b18ee076f8359b670f7655a

SHA512
ff979bfe5994a107ad97e5f3cd6829f63977f6252e97eda9e7d6cd2bbe88cca5c5659fcf5e2009f25fb4f802cf18103e6300ef09fe55f1f155ac6ee8ff8a286a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45214.exe

Filesize
468KB

MD5
c139d61d2ab5d0a3a7891c401aecc227

SHA1
fe32803ed816d80e319ff93692e4828a1b175edd

SHA256
e32dbebfb8d404d84c22dbb00cf76d49e2288e610296934160ba32426131ca17

SHA512
d7c662795b553d8fdbba20f1de432d0fafca856c9bb4775cf95364f590f15711e07c7e8e15384e07f11ecdac49133607010d817e06e3ffc0ca94817b53762ca2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49858.exe

Filesize
468KB

MD5
af1024bf054c9bac3d4188843bb7930c

SHA1
bd34d3b3ba66d04d502b3624a14e6792a62ab036

SHA256
e132fbaa45f2a3750ee91ea15a1b772c9848fa6f8a577ac51ea91ac826ccf070

SHA512
aa88748c47ffc7c06e0f3f799144bfeba286a9b7c68fb3eca0800f71802ffd376b716802f2a9e49d46d34d48426177511414c9aedb4c571915fc1607a20615a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52193.exe

Filesize
468KB

MD5
c2ff8921d37db44c7560b7678e5f9a3e

SHA1
64f61b7bc6c6a0fbc80e03837e9ebf90ff63b1cd

SHA256
bc51b17b8272dd8ca7452a7b10e3cbff7f22b678f9133c9642b2c74426925d80

SHA512
63cc1ec8d4afb51e343984d58671d6979d628ccadd07f9512b59a94ac815526d994d50284ff2e2200e12b697bed9815d8376f6b0cf989cf791607a0858ee684f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52214.exe

Filesize
468KB

MD5
541e2df54ec0ebde3807a179b9eb4112

SHA1
120129326a2ca317b456225ae3f2ce77f6021d33

SHA256
ab04d07b76ff59a468b7497c838d397770499e9a6ce2bb3a9b11070610bc77d9

SHA512
09781ad6a4662872320a4ff7e407517ccc4875f0a38d8ef099a9ae416e955b33694d3c63f42ec6221816a38778e736eb83aba816896dfb1df95db847dc2294e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52769.exe

Filesize
468KB

MD5
aa3059b682336d2d5cf5ee3164260192

SHA1
7697129967ead7d84dc305e8d198e370d53e472b

SHA256
6a3a759bd9425430a069a358425ebae22f77aa3550fbe1e58075244963dbfdc4

SHA512
5d95e3eb7454eecd8f0eb395e55493c0274a5ba734df5f67d3814489f30e2a540f3ec0dc7c0a3eb40fd158932f8c050ab08fbba8a29f1debd86609015ad2c6e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe

Filesize
468KB

MD5
80ecdcc15644b781f1d4ae6ac0b2ffea

SHA1
36112be25bbda6d8a277ff80efb5446fadcffc7f

SHA256
4e11e0848b5437d07aaae1f38bcb4d7928255b8a4b44cc08b8af9c7114622399

SHA512
56755cfcf9adb0d67eb4bf83c19e1855decfc069f201edc6516b6f651c42fa8eb95b89f8b3b791c0273a98e52369f71c7f8b6dfc1d9006db2198a3b980c252f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53781.exe

Filesize
468KB

MD5
a6c70fc5e0ca88796b144ccc82a0303a

SHA1
4c599a2f984931ab5044a1eb125a900b1c5c321e

SHA256
32d0f98138fe4227d7f5d36cefafe4182c8cab6b2a1993422890cac2c442a0b2

SHA512
ea9b1fd2ffb44aadbd5b6c187395a75c56278175ab0a732d7fcad740bd008c521a43316afb9173ddc82578974741dcf63f221c9aea8b4dea3202dc8ff324d61f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55535.exe

Filesize
468KB

MD5
5ce642e85d137b8eabb9c255f283b31d

SHA1
477208507f5712ab52f2604b3be34a8437427781

SHA256
f0284fd3525a087157e559aa15e8cb2ea723eb2ed17cb36f44966bde360ea8f9

SHA512
8bcca7c8e96081927d09bcedc8185764e5ed1033d6a5117d5cc03883800b134d7677e5c289893a7f6945889783b28afe06e75eec3da8e39a66da5036e2b30a89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58720.exe

Filesize
468KB

MD5
1d49ed92f3b8e73bc576afb9ecfb939d

SHA1
9d48a0d844a0c88d063e8a111e4df2eecb9bc707

SHA256
d72479f370fdf3fec74bad0b6bc480c93d05b14130ff0527cb0284f7a5a13a5d

SHA512
79b65d1e7816e61aca440c8ec9872ce4fbae0639cbfb2f21499718cd9c1e34b2021bedd814ea98a1f0c62512f1cfdc108335169c329b3f7522e71461ce69ede7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exe

Filesize
468KB

MD5
1d7b5a9b693d88f5ecd9793e884e4357

SHA1
790a52d711be49f3417c7d89b031d76ef4d1577e

SHA256
66be81ce1e949b308cc525dded5f3a81668714305fe1dbb4a8c288d761cdfa9a

SHA512
a8c14da52ca5271cdbbce6a3048b1632c4de23bc4988967a5d603c7a0e0e3372e587f641b83bf2a0f053784912fa064a0ec35ad74360f617393dc07c14619c01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe

Filesize
468KB

MD5
9f663de4e0330fbf3dff55122e502b47

SHA1
d4d1fab9bea8768538158e9458f9a9a0b383c5d9

SHA256
3969706c994e4548091ab3190dffcb83e8e5239eafa884ab54e54db22eb63918

SHA512
22a8ab7c8b3192a81aa46fb2dcf3feaaa1ffa8972802e8b5e9d543f22204165779a3b40fb75a22c7db115f004d8bb9433b95762e147eaba075ab0895ba44c381

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe

Filesize
468KB

MD5
9bf4c1f14ffef9689db739f4bc7a6276

SHA1
4eb797acaba9dafad8dbbb9af98a5989216dbacb

SHA256
78c02fe71e4872c079911e2ca25bd19e67c6746965e7b7d5ee9fa5a5bc9af17e

SHA512
64a4448197ac0c2308d1baaa726be3576a08b9ada33bcc078684bdf18f41113fb232efdc1be5828aec8c0428253cb39217075592d4fef74b1e975563309fcd71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62006.exe

Filesize
468KB

MD5
24787217c3fa1fc416c6f2bff0a7a654

SHA1
eee7041aaf1f1ea310657258757674d6993d9a48

SHA256
7110bb32bcb1dc20d42bcd88d233c8bb4af192d7f6f746728f459b87a09eb4d7

SHA512
f7c0fe458fea2a19209c69244be3ab6386039ec84de540465b098ece4cb6ed2818fc7ae460875525509b8e5610cf051eed099eed23016205c9129fc055e5fa70

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63432.exe

Filesize
468KB

MD5
65edbfb6561c56dec51b25df5e0b4085

SHA1
51822e17bb8a855117eb34b538ac863d6fd08b1d

SHA256
97176afffbe51b57a2cb87243df4cbb18d037be23d2f1e4955e93a459e5d19d8

SHA512
aa84d7ce99bbaba27a4ed770a98f7321141802114c70ee8e0999d7e022de03b56f3e7e93a71403b942992e524c206a8792e167207cc7cb010711c69d9b8a3113

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7404.exe

Filesize
468KB

MD5
6c9e1263a00fb33103f494be4ef6506d

SHA1
f72f74cfd52694f524cb70f799186595b304e3a6

SHA256
19069acd856cf807642f141c21c7b26c11a404a5598dc122987f22aeec85531f

SHA512
7841cae07d0d3474173027b2d8ce3651c5edaa770b3fe472901160262706ead9af6f1872621021e3da1ea43742c706a11b4160cbf9462d23992a408d37797595

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe

Filesize
468KB

MD5
4e8cfc7d4ca0b574cbdb13dc4dad44a2

SHA1
36fdeb120ad47752bedb284f5b567e71cf38b7a9

SHA256
082c71fda0a33b1d3d66711428e77cc6996667516b31fba45080c8d836dd9312

SHA512
28036bea4a2938fd8f56341ec349baac7379d7361f00e0bd823f4667a78b7e8322dd7234ff9d5bf8218adbb3ddea16af991402a9063b286def2b0649d33ce92f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe

Filesize
468KB

MD5
c08712e1e6fb0d123bb77868cbbfdb04

SHA1
db2a559438e56e4720332cb19482b7fec5d167c2

SHA256
19703725be73e9574e284eda6f1c5ee6f72880cec2765d72a978be5f0a364532

SHA512
d242dc81d5940036ddbe1c6dc7edb55d23b6ac94547c6d5c94da37f6ee591e02c9f1e77179fb08ae2220abb901e97f6cb0f1722df297e4713044154132b78cb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9785.exe

Filesize
468KB

MD5
c8612f4ac8164c0b8c3e6cac2cdc61ba

SHA1
26bc1e47f12c8bcadd5cde9e7f029512b9486924

SHA256
4b72bd4bd76e906d60fa0db138d4fcf00c6da57979ab12c4865890f2a9e492ee

SHA512
ce469f90d27a162e67b1355dc894f087caf5decf03045a61a87495a91791a0aa39c3c74c79600176024e02e9a3f10d45bc54564cbdab65e813b911395e809caf

Download Submit
memory/116-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/232-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/344-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/384-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/408-1071-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/452-100-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/620-1182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/736-807-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/912-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/964-1156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/972-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1104-1112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1156-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1160-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1284-1142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1312-1181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1316-1132-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1324-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1336-1070-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1340-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1344-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1372-1072-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1468-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1508-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1512-1161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1568-1078-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-1073-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1644-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1648-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1752-1083-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1768-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1828-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1832-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1856-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1988-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2016-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2224-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2228-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-1075-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2488-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2524-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2660-1140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2884-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-1127-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2924-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3156-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3196-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3200-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3208-148-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3308-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3344-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3416-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3440-1141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3488-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3492-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3560-1087-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3580-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3660-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3688-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3708-1133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3800-1183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3808-1180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3908-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3928-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-1085-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3988-1086-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4000-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4092-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4256-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4264-1076-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4280-1116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4296-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4348-1077-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4368-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4376-1160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4484-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4524-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4616-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4624-127-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4692-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4788-1146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4928-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4940-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4988-1084-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5024-1074-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5092-1113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5112-1179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5128-1184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7204-894-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads