f9a51f9099788f5b849ed15f0eb39646fdde34c64664069a285cd9cb3807c28c

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9a51f9099788f5b849ed15f0eb39646fdde34c64664069a285cd9cb3807c28cN.exe
Size

468KB
MD5

ea530fddad775267b6353de22d63bd10
SHA1

92ee5ed34997b5a11295666310b772c24fad1ba5
SHA256

f9a51f9099788f5b849ed15f0eb39646fdde34c64664069a285cd9cb3807c28c
SHA512

3dc74c170a9c401bc0369d490cacb5eb3bc14525915bcd703a8f4ecb779d07c6b163d9953a82315258800f42814f2fa4e678b31e6c98d271d67c596f72cfec79
SSDEEP

3072:13mCogWxjQ8pmbxSPz/Czf8/EChbSDpoymHBaVKZLEd3WldFDbm4:13roBdpmcPbCzfXdgHLE9mdFD

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1796	Unicorn-4004.exe
936	Unicorn-21597.exe
540	Unicorn-59100.exe
5360	Unicorn-32557.exe
3076	Unicorn-56869.exe
5084	Unicorn-50739.exe
4584	Unicorn-37003.exe
4664	Unicorn-32277.exe
1208	Unicorn-45084.exe
4588	Unicorn-17861.exe
1720	Unicorn-30475.exe
3588	Unicorn-17669.exe
428	Unicorn-26148.exe
5752	Unicorn-26413.exe
2792	Unicorn-20282.exe
1496	Unicorn-4020.exe
5588	Unicorn-55756.exe
6072	Unicorn-26037.exe
1940	Unicorn-30186.exe
2776	Unicorn-36701.exe
5028	Unicorn-52845.exe
2108	Unicorn-32979.exe
5420	Unicorn-20173.exe
2824	Unicorn-36509.exe
436	Unicorn-29418.exe
3596	Unicorn-35549.exe
5372	Unicorn-35284.exe
5264	Unicorn-18450.exe
5248	Unicorn-56332.exe
3916	Unicorn-64884.exe
2744	Unicorn-6716.exe
5808	Unicorn-55917.exe
5032	Unicorn-19715.exe
1160	Unicorn-25282.exe
3812	Unicorn-4132.exe
5688	Unicorn-58164.exe
4708	Unicorn-60541.exe
3456	Unicorn-27412.exe
1792	Unicorn-27677.exe
1620	Unicorn-65180.exe
3108	Unicorn-219.exe
5668	Unicorn-29981.exe
1800	Unicorn-50572.exe
2364	Unicorn-45933.exe
1740	Unicorn-56213.exe
1900	Unicorn-61044.exe
2272	Unicorn-44900.exe
5468	Unicorn-25077.exe
6088	Unicorn-35091.exe
1840	Unicorn-24885.exe
2952	Unicorn-8932.exe
4704	Unicorn-41797.exe
6116	Unicorn-43643.exe
5568	Unicorn-49773.exe
2848	Unicorn-64957.exe
1544	Unicorn-49197.exe
3260	Unicorn-26730.exe
2896	Unicorn-12995.exe
3664	Unicorn-40837.exe
5612	Unicorn-24501.exe
5540	Unicorn-63068.exe
2092	Unicorn-30853.exe
648	Unicorn-13754.exe
4972	Unicorn-22685.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3680	6212	WerFault.exe	219
15324	6380	WerFault.exe	671
3956	14780	WerFault.exe	664
4552	6368	WerFault.exe	667

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32149.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6912	dwm.exe
Token: SeChangeNotifyPrivilege	6912	dwm.exe
Token: 33	6912	dwm.exe
Token: SeIncBasePriorityPrivilege	6912	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5560	f9a51f9099788f5b849ed15f0eb39646fdde34c64664069a285cd9cb3807c28cN.exe
1796	Unicorn-4004.exe
936	Unicorn-21597.exe
540	Unicorn-59100.exe
5360	Unicorn-32557.exe
3076	Unicorn-56869.exe
5084	Unicorn-50739.exe
4584	Unicorn-37003.exe
4664	Unicorn-32277.exe
1208	Unicorn-45084.exe
4588	Unicorn-17861.exe
1720	Unicorn-30475.exe
3588	Unicorn-17669.exe
5752	Unicorn-26413.exe
428	Unicorn-26148.exe
2792	Unicorn-20282.exe
1496	Unicorn-4020.exe
5588	Unicorn-55756.exe
6072	Unicorn-26037.exe
1940	Unicorn-30186.exe
2776	Unicorn-36701.exe
2824	Unicorn-36509.exe
5420	Unicorn-20173.exe
2108	Unicorn-32979.exe
5028	Unicorn-52845.exe
5248	Unicorn-56332.exe
3596	Unicorn-35549.exe
3916	Unicorn-64884.exe
436	Unicorn-29418.exe
5372	Unicorn-35284.exe
5264	Unicorn-18450.exe
5808	Unicorn-55917.exe
2744	Unicorn-6716.exe
5032	Unicorn-19715.exe
1160	Unicorn-25282.exe
3812	Unicorn-4132.exe
4708	Unicorn-60541.exe
5688	Unicorn-58164.exe
3456	Unicorn-27412.exe
3108	Unicorn-219.exe
1792	Unicorn-27677.exe
1620	Unicorn-65180.exe
5668	Unicorn-29981.exe
1800	Unicorn-50572.exe
2364	Unicorn-45933.exe
1900	Unicorn-61044.exe
1740	Unicorn-56213.exe
2272	Unicorn-44900.exe
5468	Unicorn-25077.exe
6088	Unicorn-35091.exe
1840	Unicorn-24885.exe
2952	Unicorn-8932.exe
6116	Unicorn-43643.exe
4704	Unicorn-41797.exe
5568	Unicorn-49773.exe
3260	Unicorn-26730.exe
2896	Unicorn-12995.exe
2848	Unicorn-64957.exe
1544	Unicorn-49197.exe
3664	Unicorn-40837.exe
5540	Unicorn-63068.exe
5612	Unicorn-24501.exe
2092	Unicorn-30853.exe
2088	Unicorn-42699.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5560 wrote to memory of 1796	5560	f9a51f9099788f5b849ed15f0eb39646fdde34c64664069a285cd9cb3807c28cN.exe	91
PID 5560 wrote to memory of 1796	5560	f9a51f9099788f5b849ed15f0eb39646fdde34c64664069a285cd9cb3807c28cN.exe	91
PID 5560 wrote to memory of 1796	5560	f9a51f9099788f5b849ed15f0eb39646fdde34c64664069a285cd9cb3807c28cN.exe	91
PID 1796 wrote to memory of 936	1796	Unicorn-4004.exe	94
PID 1796 wrote to memory of 936	1796	Unicorn-4004.exe	94
PID 1796 wrote to memory of 936	1796	Unicorn-4004.exe	94
PID 5560 wrote to memory of 540	5560	f9a51f9099788f5b849ed15f0eb39646fdde34c64664069a285cd9cb3807c28cN.exe	95
PID 5560 wrote to memory of 540	5560	f9a51f9099788f5b849ed15f0eb39646fdde34c64664069a285cd9cb3807c28cN.exe	95
PID 5560 wrote to memory of 540	5560	f9a51f9099788f5b849ed15f0eb39646fdde34c64664069a285cd9cb3807c28cN.exe	95
PID 936 wrote to memory of 5360	936	Unicorn-21597.exe	97
PID 936 wrote to memory of 5360	936	Unicorn-21597.exe	97
PID 936 wrote to memory of 5360	936	Unicorn-21597.exe	97
PID 540 wrote to memory of 3076	540	Unicorn-59100.exe	98
PID 540 wrote to memory of 3076	540	Unicorn-59100.exe	98
PID 540 wrote to memory of 3076	540	Unicorn-59100.exe	98
PID 5560 wrote to memory of 5084	5560	f9a51f9099788f5b849ed15f0eb39646fdde34c64664069a285cd9cb3807c28cN.exe	99
PID 5560 wrote to memory of 5084	5560	f9a51f9099788f5b849ed15f0eb39646fdde34c64664069a285cd9cb3807c28cN.exe	99
PID 5560 wrote to memory of 5084	5560	f9a51f9099788f5b849ed15f0eb39646fdde34c64664069a285cd9cb3807c28cN.exe	99
PID 1796 wrote to memory of 4584	1796	Unicorn-4004.exe	100
PID 1796 wrote to memory of 4584	1796	Unicorn-4004.exe	100
PID 1796 wrote to memory of 4584	1796	Unicorn-4004.exe	100
PID 5360 wrote to memory of 4664	5360	Unicorn-32557.exe	104
PID 5360 wrote to memory of 4664	5360	Unicorn-32557.exe	104
PID 5360 wrote to memory of 4664	5360	Unicorn-32557.exe	104
PID 936 wrote to memory of 1208	936	Unicorn-21597.exe	105
PID 936 wrote to memory of 1208	936	Unicorn-21597.exe	105
PID 936 wrote to memory of 1208	936	Unicorn-21597.exe	105
PID 3076 wrote to memory of 4588	3076	Unicorn-56869.exe	106
PID 3076 wrote to memory of 4588	3076	Unicorn-56869.exe	106
PID 3076 wrote to memory of 4588	3076	Unicorn-56869.exe	106
PID 540 wrote to memory of 1720	540	Unicorn-59100.exe	107
PID 540 wrote to memory of 1720	540	Unicorn-59100.exe	107
PID 540 wrote to memory of 1720	540	Unicorn-59100.exe	107
PID 5084 wrote to memory of 3588	5084	Unicorn-50739.exe	108
PID 5084 wrote to memory of 3588	5084	Unicorn-50739.exe	108
PID 5084 wrote to memory of 3588	5084	Unicorn-50739.exe	108
PID 5560 wrote to memory of 428	5560	f9a51f9099788f5b849ed15f0eb39646fdde34c64664069a285cd9cb3807c28cN.exe	109
PID 5560 wrote to memory of 428	5560	f9a51f9099788f5b849ed15f0eb39646fdde34c64664069a285cd9cb3807c28cN.exe	109
PID 5560 wrote to memory of 428	5560	f9a51f9099788f5b849ed15f0eb39646fdde34c64664069a285cd9cb3807c28cN.exe	109
PID 4584 wrote to memory of 5752	4584	Unicorn-37003.exe	110
PID 4584 wrote to memory of 5752	4584	Unicorn-37003.exe	110
PID 4584 wrote to memory of 5752	4584	Unicorn-37003.exe	110
PID 1796 wrote to memory of 2792	1796	Unicorn-4004.exe	111
PID 1796 wrote to memory of 2792	1796	Unicorn-4004.exe	111
PID 1796 wrote to memory of 2792	1796	Unicorn-4004.exe	111
PID 4664 wrote to memory of 1496	4664	Unicorn-32277.exe	112
PID 4664 wrote to memory of 1496	4664	Unicorn-32277.exe	112
PID 4664 wrote to memory of 1496	4664	Unicorn-32277.exe	112
PID 5360 wrote to memory of 5588	5360	Unicorn-32557.exe	113
PID 5360 wrote to memory of 5588	5360	Unicorn-32557.exe	113
PID 5360 wrote to memory of 5588	5360	Unicorn-32557.exe	113
PID 1208 wrote to memory of 6072	1208	Unicorn-45084.exe	114
PID 1208 wrote to memory of 6072	1208	Unicorn-45084.exe	114
PID 1208 wrote to memory of 6072	1208	Unicorn-45084.exe	114
PID 936 wrote to memory of 1940	936	Unicorn-21597.exe	115
PID 936 wrote to memory of 1940	936	Unicorn-21597.exe	115
PID 936 wrote to memory of 1940	936	Unicorn-21597.exe	115
PID 4588 wrote to memory of 2776	4588	Unicorn-17861.exe	116
PID 4588 wrote to memory of 2776	4588	Unicorn-17861.exe	116
PID 4588 wrote to memory of 2776	4588	Unicorn-17861.exe	116
PID 1720 wrote to memory of 5028	1720	Unicorn-30475.exe	117
PID 1720 wrote to memory of 5028	1720	Unicorn-30475.exe	117
PID 1720 wrote to memory of 5028	1720	Unicorn-30475.exe	117
PID 3076 wrote to memory of 2108	3076	Unicorn-56869.exe	118

C:\Users\Admin\AppData\Local\Temp\f9a51f9099788f5b849ed15f0eb39646fdde34c64664069a285cd9cb3807c28cN.exe
"C:\Users\Admin\AppData\Local\Temp\f9a51f9099788f5b849ed15f0eb39646fdde34c64664069a285cd9cb3807c28cN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5560
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4004.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4004.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21597.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32557.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32277.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4020.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6716.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24501.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        9⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28.exe
        10⤵
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18117.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29699.exe
        11⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12997.exe
        11⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29003.exe
        10⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59667.exe
        10⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56112.exe
        10⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        9⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12268.exe
        10⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-310.exe
        10⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
        9⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42286.exe
        9⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7827.exe
        8⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30213.exe
        9⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44702.exe
        9⤵
        
        PID:18248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11498.exe
        8⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58900.exe
        8⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51031.exe
        8⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe
        8⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39141.exe
        9⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47909.exe
        10⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exe
        10⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-990.exe
        10⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19579.exe
        9⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        9⤵
        
        PID:16076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48004.exe
        8⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60611.exe
        8⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        8⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        8⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54619.exe
        7⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45773.exe
        8⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
        8⤵
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60855.exe
        8⤵
        
        PID:18112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20235.exe
        7⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26202.exe
        7⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe
        7⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62492.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4340.exe
        8⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        9⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25266.exe
        9⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35007.exe
        9⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55132.exe
        8⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15460.exe
        9⤵
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47694.exe
        9⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6226.exe
        8⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34125.exe
        8⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6674.exe
        7⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40509.exe
        8⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4323.exe
        8⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59127.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35724.exe
        7⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2215.exe
        8⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5450.exe
        7⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57087.exe
        7⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe
        6⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28933.exe
        7⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6212 -s 488
        8⤵
        Program crash
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39171.exe
        7⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12370.exe
        7⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17590.exe
        7⤵
        
        PID:17404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27428.exe
        6⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
        7⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe
        7⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34815.exe
        7⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        6⤵
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-835.exe
        6⤵
        
        PID:13088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55917.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64957.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40853.exe
        8⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16261.exe
        9⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59253.exe
        10⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        10⤵
        
        PID:17664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe
        9⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        9⤵
        
        PID:14316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43822.exe
        9⤵
        
        PID:16940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62804.exe
        8⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        9⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65323.exe
        8⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56404.exe
        8⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26341.exe
        8⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        7⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5700.exe
        8⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
        8⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        8⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10190.exe
        8⤵
        
        PID:17748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4178.exe
        7⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        7⤵
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe
        7⤵
        
        PID:15116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53592.exe
        7⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59228.exe
        6⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
        7⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42901.exe
        8⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1427.exe
        8⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12910.exe
        8⤵
        
        PID:18412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40707.exe
        7⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13524.exe
        8⤵
        
        PID:15408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        8⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
        7⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        7⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24826.exe
        6⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        7⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        7⤵
        
        PID:15580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        7⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19859.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19667.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22543.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25282.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30853.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        7⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16749.exe
        8⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
        9⤵
        
        PID:15448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        9⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36595.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
        8⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34981.exe
        8⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12363.exe
        7⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28706.exe
        7⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49300.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        7⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16379.exe
        6⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-412.exe
        7⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16789.exe
        8⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29387.exe
        7⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
        7⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33549.exe
        7⤵
        
        PID:17504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3130.exe
        6⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64661.exe
        7⤵
        
        PID:16312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-414.exe
        7⤵
        
        PID:17240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26404.exe
        6⤵
        
        PID:12004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40635.exe
        6⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9767.exe
        6⤵
        
        PID:17616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe
        5⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1844.exe
        6⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36757.exe
        7⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
        7⤵
        
        PID:14860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33883.exe
        6⤵
        
        PID:9156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
        6⤵
        
        PID:12312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18557.exe
        6⤵
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13858.exe
        5⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
        6⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe
        6⤵
        
        PID:12916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe
        6⤵
        
        PID:16284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47502.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60749.exe
        5⤵
        
        PID:12944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12549.exe
        5⤵
        
        PID:16168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26037.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4132.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62565.exe
        7⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42877.exe
        8⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14452.exe
        9⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27763.exe
        9⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33458.exe
        9⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7125.exe
        9⤵
        
        PID:19396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8995.exe
        8⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47580.exe
        8⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26341.exe
        8⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42035.exe
        7⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3892.exe
        8⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        9⤵
        
        PID:17324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34971.exe
        8⤵
        
        PID:14768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13994.exe
        7⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61572.exe
        7⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43296.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18579.exe
        6⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
        8⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64083.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11541.exe
        8⤵
        
        PID:17820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22259.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
        7⤵
        
        PID:12444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
        7⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32639.exe
        7⤵
        
        PID:17768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14738.exe
        6⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48869.exe
        7⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        7⤵
        
        PID:16356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36926.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19859.exe
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        6⤵
        
        PID:12996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48553.exe
        6⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65180.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32005.exe
        6⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42877.exe
        7⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25109.exe
        8⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34557.exe
        9⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64991.exe
        9⤵
        
        PID:18420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61868.exe
        8⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59667.exe
        8⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
        8⤵
        
        PID:18976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38019.exe
        7⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32214.exe
        8⤵
        
        PID:15248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59756.exe
        7⤵
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2982.exe
        7⤵
        
        PID:17544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17146.exe
        6⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40509.exe
        7⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21042.exe
        7⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49175.exe
        7⤵
        
        PID:17196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        6⤵
        
        PID:9712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35538.exe
        6⤵
        
        PID:14856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39935.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17322.exe
        5⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57293.exe
        6⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50701.exe
        7⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53838.exe
        7⤵
        
        PID:16480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24306.exe
        6⤵
        
        PID:14464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        6⤵
        
        PID:11420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47119.exe
        6⤵
        
        PID:17264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21770.exe
        5⤵
        
        PID:10268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29667.exe
        5⤵
        
        PID:13136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        5⤵
        
        PID:15332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30186.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60541.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18373.exe
        7⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8196.exe
        8⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        9⤵
        
        PID:11660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7622.exe
        9⤵
        
        PID:19436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61868.exe
        8⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59667.exe
        8⤵
        
        PID:16364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24343.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38019.exe
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
        8⤵
        
        PID:17648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20538.exe
        7⤵
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18739.exe
        7⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33357.exe
        7⤵
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35787.exe
        6⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42901.exe
        7⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1427.exe
        7⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28095.exe
        7⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13994.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36202.exe
        6⤵
        
        PID:12912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36384.exe
        6⤵
        
        PID:17216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59405.exe
        6⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1756.exe
        7⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17173.exe
        8⤵
        
        PID:15248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3869.exe
        8⤵
        
        PID:18984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40051.exe
        7⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
        7⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40707.exe
        6⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48551.exe
        7⤵
        
        PID:11408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3346.exe
        6⤵
        
        PID:10544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
        6⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23012.exe
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30125.exe
        6⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8075.exe
        6⤵
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21445.exe
        6⤵
        
        PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe
        5⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe
        5⤵
        
        PID:14708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56809.exe
        5⤵
        
        PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62757.exe
        5⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5300.exe
        6⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32149.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe
        7⤵
        
        PID:15520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16558.exe
        7⤵
        
        PID:17452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38027.exe
        6⤵
        
        PID:10080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22284.exe
        6⤵
        
        PID:14820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28128.exe
        6⤵
        
        PID:14668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58476.exe
        5⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19077.exe
        6⤵
        
        PID:11884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29699.exe
        6⤵
        
        PID:15440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3486.exe
        6⤵
        
        PID:16844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6506.exe
        5⤵
        
        PID:9944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54572.exe
        5⤵
        
        PID:14752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe
        5⤵
        
        PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63723.exe
      4⤵
      PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21357.exe
        5⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62797.exe
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49108.exe
        6⤵
        
        PID:14628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62094.exe
        6⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26787.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        5⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2614.exe
        5⤵
        
        PID:11396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23467.exe
      4⤵
      PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32149.exe
        5⤵
        
        PID:11172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe
        5⤵
        
        PID:15220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe
        5⤵
        
        PID:16220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18670.exe
        5⤵
        
        PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22300.exe
      4⤵
      PID:10244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41154.exe
      4⤵
      PID:15068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47094.exe
      4⤵
      PID:10972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37003.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20173.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45933.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
        7⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5700.exe
        8⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        9⤵
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23190.exe
        9⤵
        
        PID:17384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50244.exe
        8⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1826.exe
        8⤵
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe
        8⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        7⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6995.exe
        7⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23530.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19318.exe
        7⤵
        
        PID:16836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60956.exe
        6⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
        7⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exe
        8⤵
        
        PID:12176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64676.exe
        8⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22213.exe
        8⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
        7⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        7⤵
        
        PID:16264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        6⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37157.exe
        7⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63158.exe
        7⤵
        
        PID:17832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62155.exe
        6⤵
        
        PID:15132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31295.exe
        6⤵
        
        PID:14796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44900.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        6⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20293.exe
        7⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13980.exe
        8⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51220.exe
        8⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40295.exe
        8⤵
        
        PID:19376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59.exe
        7⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37171.exe
        7⤵
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        7⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36171.exe
        6⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36757.exe
        7⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        7⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1950.exe
        7⤵
        
        PID:16604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13034.exe
        6⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28128.exe
        6⤵
        
        PID:16548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52107.exe
        5⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        6⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8196.exe
        7⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        8⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        9⤵
        
        PID:16744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19246.exe
        8⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37363.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59667.exe
        7⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38019.exe
        6⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20538.exe
        6⤵
        
        PID:12096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26828.exe
        6⤵
        
        PID:15664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        6⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3691.exe
        5⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29053.exe
        6⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54571.exe
        6⤵
        
        PID:14220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55852.exe
        6⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11570.exe
        5⤵
        
        PID:8388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60980.exe
        5⤵
        
        PID:12692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27022.exe
        5⤵
        
        PID:16528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64884.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24885.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-292.exe
        6⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exe
        7⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32637.exe
        8⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27597.exe
        8⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49755.exe
        7⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        7⤵
        
        PID:16168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7886.exe
        7⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42819.exe
        6⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        7⤵
        
        PID:15344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46351.exe
        7⤵
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59931.exe
        6⤵
        
        PID:10420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53716.exe
        6⤵
        
        PID:15400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        6⤵
        
        PID:8888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47116.exe
        5⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8092.exe
        6⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        7⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exe
        7⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
        7⤵
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47940.exe
        6⤵
        
        PID:10276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35458.exe
        6⤵
        
        PID:16100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30335.exe
        6⤵
        
        PID:18288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33586.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45237.exe
        6⤵
        
        PID:14368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36350.exe
        6⤵
        
        PID:17860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe
        5⤵
        
        PID:10656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45221.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43643.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
        6⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe
        7⤵
        
        PID:12392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54172.exe
        6⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
        6⤵
        
        PID:15568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        5⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19581.exe
        6⤵
        
        PID:516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62495.exe
        6⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59163.exe
        5⤵
        
        PID:10640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29404.exe
        5⤵
        
        PID:15524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-685.exe
        5⤵
        
        PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11179.exe
      4⤵
      PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53355.exe
      4⤵
      PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5708.exe
        5⤵
        
        PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35739.exe
        5⤵
        
        PID:14592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12038.exe
        5⤵
        
        PID:17148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
      4⤵
      PID:9084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50957.exe
      4⤵
      PID:13068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
      4⤵
      PID:3972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20282.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29981.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32197.exe
        6⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16261.exe
        7⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42149.exe
        8⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        7⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19959.exe
        7⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54724.exe
        6⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10908.exe
        7⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17902.exe
        7⤵
        
        PID:17528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32354.exe
        6⤵
        
        PID:9496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3171.exe
        6⤵
        
        PID:14624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
        6⤵
        
        PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        5⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16261.exe
        6⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        7⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5021.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33802.exe
        6⤵
        
        PID:10744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        6⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9422.exe
        6⤵
        
        PID:19316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10427.exe
        5⤵
        
        PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15242.exe
        5⤵
        
        PID:9908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40331.exe
        5⤵
        
        PID:16348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
        5⤵
        
        PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
        5⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
        7⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51220.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53367.exe
        7⤵
        
        PID:18236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65220.exe
        6⤵
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55339.exe
        6⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30679.exe
        6⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1683.exe
        5⤵
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34365.exe
        6⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22317.exe
        6⤵
        
        PID:17556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3171.exe
        5⤵
        
        PID:14544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        5⤵
        
        PID:17224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17619.exe
      4⤵
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5892.exe
        5⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1780.exe
        6⤵
        
        PID:11948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64676.exe
        6⤵
        
        PID:14352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44084.exe
        5⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40643.exe
        5⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2614.exe
        5⤵
        
        PID:11388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24635.exe
      4⤵
      PID:8712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18268.exe
      4⤵
      PID:12028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
      4⤵
      PID:15548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
      4⤵
      PID:16492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35284.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49197.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27589.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
        6⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28709.exe
        7⤵
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        7⤵
        
        PID:19292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20643.exe
        6⤵
        
        PID:10388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35163.exe
        6⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65070.exe
        6⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
        5⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12037.exe
        6⤵
        
        PID:17704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        5⤵
        
        PID:15656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe
        5⤵
        
        PID:16672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43.exe
      4⤵
      PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29053.exe
        5⤵
        
        PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48516.exe
        5⤵
        
        PID:12056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61727.exe
        5⤵
        
        PID:15696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15138.exe
      4⤵
      PID:9204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35636.exe
      4⤵
      PID:11624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4898.exe
      4⤵
      PID:14432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7886.exe
      4⤵
      PID:1356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13754.exe
    3⤵
    - Executes dropped EXE
    PID:648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
      4⤵
      PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1756.exe
        5⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40051.exe
        5⤵
        
        PID:11512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
        5⤵
        
        PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21883.exe
      4⤵
      PID:9832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22947.exe
      4⤵
      PID:16224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64054.exe
      4⤵
      PID:17872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
    3⤵
    PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
      4⤵
      PID:8676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14882.exe
      4⤵
      PID:13060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50078.exe
      4⤵
      PID:8260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12100.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5202.exe
    3⤵
    PID:12576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14623.exe
    3⤵
    PID:19408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59100.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59100.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17861.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36701.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46613.exe
        7⤵
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
        8⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        9⤵
        
        PID:11648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15883.exe
        9⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53262.exe
        9⤵
        
        PID:17128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
        8⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4775.exe
        8⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62508.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13700.exe
        8⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        8⤵
        
        PID:15664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42215.exe
        8⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40523.exe
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3171.exe
        7⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11245.exe
        7⤵
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        6⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21061.exe
        7⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12140.exe
        8⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8251.exe
        8⤵
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51015.exe
        8⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5739.exe
        7⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54851.exe
        7⤵
        
        PID:12976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44519.exe
        7⤵
        
        PID:16864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        6⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        7⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        7⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35007.exe
        7⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        6⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60043.exe
        6⤵
        
        PID:14444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60888.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-219.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        6⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42877.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8580.exe
        8⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
        8⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
        8⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38403.exe
        7⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51981.exe
        8⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14446.exe
        8⤵
        
        PID:17468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59756.exe
        7⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40750.exe
        7⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
        6⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3892.exe
        7⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3259.exe
        7⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10885.exe
        7⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35538.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51661.exe
        6⤵
        
        PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58547.exe
        5⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53749.exe
        7⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16035.exe
        7⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        6⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48023.exe
        6⤵
        
        PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61636.exe
        5⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
        6⤵
        
        PID:9568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41987.exe
        6⤵
        
        PID:14416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57840.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11194.exe
        5⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35515.exe
        5⤵
        
        PID:12968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61942.exe
        5⤵
        
        PID:17032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
        6⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16261.exe
        7⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33405.exe
        8⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5021.exe
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47940.exe
        7⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39935.exe
        7⤵
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        6⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29757.exe
        7⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
        7⤵
        
        PID:16616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe
        6⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54868.exe
        6⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-685.exe
        6⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12907.exe
        5⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23277.exe
        6⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19461.exe
        7⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2683.exe
        7⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50439.exe
        7⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26787.exe
        6⤵
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        6⤵
        
        PID:14684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe
        6⤵
        
        PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exe
        5⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
        6⤵
        
        PID:16084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8235.exe
        5⤵
        
        PID:10488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54925.exe
        5⤵
        
        PID:19304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35091.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        5⤵
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36925.exe
        6⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48869.exe
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
        7⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38451.exe
        7⤵
        
        PID:15128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18670.exe
        7⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19091.exe
        6⤵
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58219.exe
        6⤵
        
        PID:14564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59511.exe
        6⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21667.exe
        5⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24469.exe
        6⤵
        
        PID:12244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36351.exe
        6⤵
        
        PID:17252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7082.exe
        5⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5283.exe
        5⤵
        
        PID:6368
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6368 -s 464
        6⤵
        Program crash
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-685.exe
        5⤵
        
        PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9259.exe
      4⤵
      PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16261.exe
        5⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26336.exe
        6⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        5⤵
        
        PID:16276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        5⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35654.exe
        5⤵
        
        PID:17232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
      4⤵
      PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1639.exe
        5⤵
        
        PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6875.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57397.exe
      4⤵
      PID:16328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11414.exe
      4⤵
      PID:18476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30475.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56213.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe
        6⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5892.exe
        7⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exe
        8⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exe
        8⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35479.exe
        8⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10835.exe
        7⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64955.exe
        7⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51623.exe
        7⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10618.exe
        6⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
        6⤵
        
        PID:12264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53132.exe
        6⤵
        
        PID:15124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50992.exe
        6⤵
        
        PID:15600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11754.exe
        5⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5700.exe
        6⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe
        7⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30485.exe
        7⤵
        
        PID:17516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12283.exe
        6⤵
        
        PID:11204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        6⤵
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
        6⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-147.exe
        5⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12564.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23382.exe
        6⤵
        
        PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63867.exe
        5⤵
        
        PID:10040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22947.exe
        5⤵
        
        PID:16204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53773.exe
        5⤵
        
        PID:16520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        5⤵
        
        PID:852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5020.exe
        6⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5236.exe
        7⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46876.exe
        7⤵
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
        7⤵
        
        PID:16100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18619.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        6⤵
        
        PID:14816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29067.exe
        5⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42149.exe
        6⤵
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49671.exe
        6⤵
        
        PID:19276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39668.exe
        5⤵
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39483.exe
        5⤵
        
        PID:16232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2751.exe
        5⤵
        
        PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9154.exe
      4⤵
      PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
        5⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21869.exe
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32511.exe
        6⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26787.exe
        5⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        5⤵
        
        PID:15232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        5⤵
        
        PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
      4⤵
      PID:7484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31515.exe
        5⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53559.exe
        5⤵
        
        PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65107.exe
      4⤵
      PID:10480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4203.exe
      4⤵
      PID:15512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27344.exe
      4⤵
      PID:4828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29418.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49773.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19805.exe
        5⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29437.exe
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16035.exe
        6⤵
        
        PID:12292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe
        6⤵
        
        PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14475.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18146.exe
        5⤵
        
        PID:10600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18739.exe
        5⤵
        
        PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24931.exe
      4⤵
      PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
        5⤵
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6138.exe
        5⤵
        
        PID:14372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        5⤵
        
        PID:16856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14370.exe
      4⤵
      PID:7684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4307.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
      4⤵
      PID:220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17939.exe
        5⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3834.exe
        5⤵
        
        PID:13128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
        5⤵
        
        PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20723.exe
      4⤵
      PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe
        5⤵
        
        PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4742.exe
        5⤵
        
        PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20538.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59987.exe
    3⤵
    PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28397.exe
      4⤵
      PID:9976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10851.exe
      4⤵
      PID:14800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
      4⤵
      PID:6156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20307.exe
    3⤵
    PID:6164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61517.exe
    3⤵
    PID:12760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47978.exe
    3⤵
    PID:15224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25335.exe
    3⤵
    PID:5512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38222.exe
    3⤵
    PID:17760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50739.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50739.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35549.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41797.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        6⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18181.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49805.exe
        8⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36109.exe
        9⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35582.exe
        9⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12475.exe
        8⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59667.exe
        8⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe
        8⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38019.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52539.exe
        7⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22483.exe
        7⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58372.exe
        6⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32149.exe
        7⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18670.exe
        7⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13994.exe
        6⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60716.exe
        6⤵
        
        PID:13016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46644.exe
        5⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39141.exe
        6⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31515.exe
        7⤵
        
        PID:14012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60420.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe
        6⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61739.exe
        5⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12111.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-939.exe
        5⤵
        
        PID:11336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39483.exe
        5⤵
        
        PID:16044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20047.exe
        5⤵
        
        PID:17848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35757.exe
        5⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25723.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44675.exe
        6⤵
        
        PID:14132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
        5⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe
        6⤵
        
        PID:14780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14780 -s 436
        7⤵
        Program crash
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56439.exe
        6⤵
        
        PID:17420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3818.exe
        5⤵
        
        PID:11932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48532.exe
        5⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35853.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21946.exe
      4⤵
      PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49805.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28256.exe
        6⤵
        
        PID:17112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12475.exe
        5⤵
        
        PID:10116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59667.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        5⤵
        
        PID:16228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8995.exe
      4⤵
      PID:8584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47077.exe
        5⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6854.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17738.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59076.exe
      4⤵
      PID:14512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45605.exe
      4⤵
      PID:17564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56332.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8932.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
        5⤵
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21149.exe
        6⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
        7⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        8⤵
        
        PID:15172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24046.exe
        8⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47171.exe
        7⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
        7⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38019.exe
        6⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64069.exe
        7⤵
        
        PID:14480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59756.exe
        6⤵
        
        PID:12512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40750.exe
        6⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65388.exe
        5⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
        6⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14882.exe
        6⤵
        
        PID:13152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9237.exe
        6⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14370.exe
        5⤵
        
        PID:8364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20643.exe
        5⤵
        
        PID:12680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        5⤵
        
        PID:17192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
      4⤵
      PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54221.exe
        5⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        6⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        6⤵
        
        PID:14380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16750.exe
        6⤵
        
        PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26787.exe
        5⤵
        
        PID:9448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64955.exe
        5⤵
        
        PID:6380
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6380 -s 468
        6⤵
        Program crash
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64596.exe
        5⤵
        
        PID:16144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
        5⤵
        
        PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64915.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63773.exe
        5⤵
        
        PID:14528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
      4⤵
      PID:10612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe
      4⤵
      PID:15588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34694.exe
      4⤵
      PID:6820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26730.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40853.exe
      4⤵
      PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
        5⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31515.exe
        6⤵
        
        PID:14020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12997.exe
        6⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54556.exe
        5⤵
        
        PID:10572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33926.exe
        5⤵
        
        PID:1320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62804.exe
      4⤵
      PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19581.exe
        5⤵
        
        PID:13140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38654.exe
        5⤵
        
        PID:16932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58691.exe
      4⤵
      PID:10168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16907.exe
      4⤵
      PID:15124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9806.exe
      4⤵
      PID:6696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18963.exe
    3⤵
    PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe
      4⤵
      PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        5⤵
        
        PID:15284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12910.exe
        5⤵
        
        PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61764.exe
      4⤵
      PID:10620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
      4⤵
      PID:17628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe
    3⤵
    PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42149.exe
      4⤵
      PID:11944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe
      4⤵
      PID:17476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34451.exe
    3⤵
    PID:11528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63047.exe
    3⤵
    PID:3168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58164.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58164.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59789.exe
        5⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
        6⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
        6⤵
        
        PID:14784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2525.exe
        6⤵
        
        PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17355.exe
        5⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
        6⤵
        
        PID:16092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62251.exe
        5⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4245.exe
        5⤵
        
        PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44532.exe
      4⤵
      PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
        5⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17291.exe
        5⤵
        
        PID:12732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26071.exe
        5⤵
        
        PID:376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13034.exe
      4⤵
      PID:8424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58239.exe
      4⤵
      PID:17600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40483.exe
    3⤵
    PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
      4⤵
      PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59125.exe
        5⤵
        
        PID:7752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40051.exe
        5⤵
        
        PID:11500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10005.exe
        5⤵
        
        PID:17432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54740.exe
      4⤵
      PID:8740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16981.exe
        5⤵
        
        PID:15504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63839.exe
        5⤵
        
        PID:17336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
      4⤵
      PID:12436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20603.exe
    3⤵
    PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19461.exe
      4⤵
      PID:10188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2683.exe
      4⤵
      PID:14832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9734.exe
      4⤵
      PID:17720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34930.exe
    3⤵
    PID:9468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
    3⤵
    PID:12708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39357.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39357.exe
    3⤵
    PID:17184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18450.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18450.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40837.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40853.exe
      4⤵
      PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16261.exe
        5⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55221.exe
        6⤵
        
        PID:15104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35935.exe
        6⤵
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe
        5⤵
        
        PID:10316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        5⤵
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        5⤵
        
        PID:17172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62804.exe
      4⤵
      PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45325.exe
        5⤵
        
        PID:12768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
        5⤵
        
        PID:17164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58115.exe
      4⤵
      PID:10548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
      4⤵
      PID:16256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50071.exe
      4⤵
      PID:17684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6379.exe
    3⤵
    PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
      4⤵
      PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        5⤵
        
        PID:15272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15686.exe
        5⤵
        
        PID:16080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20258.exe
      4⤵
      PID:12164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8085.exe
      4⤵
      PID:18076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51372.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59451.exe
    3⤵
    PID:12040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21035.exe
    3⤵
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10535.exe
    3⤵
    PID:2568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21147.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21147.exe
  2⤵
  PID:208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27973.exe
    3⤵
    PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
      4⤵
      PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13804.exe
        5⤵
        
        PID:14920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15878.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52932.exe
      4⤵
      PID:11244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
      4⤵
      PID:16156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
      4⤵
      PID:17372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12458.exe
    3⤵
    PID:9440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16981.exe
      4⤵
      PID:15756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
      4⤵
      PID:18428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
    3⤵
    PID:14536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7655.exe
    3⤵
    PID:7784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36397.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36397.exe
  2⤵
  PID:6888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28861.exe
    3⤵
    PID:4812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23435.exe
    3⤵
    PID:12544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16750.exe
    3⤵
    PID:15676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe
  2⤵
  PID:8236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37837.exe
    3⤵
    PID:15844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64799.exe
    3⤵
    PID:6824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34843.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34843.exe
  2⤵
  PID:12712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16735.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16735.exe
  2⤵
  PID:17584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4380,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
1⤵
PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6212 -ip 6212
1⤵
PID:7712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6368 -ip 6368
1⤵
PID:1936

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11412.exe

Filesize
468KB

MD5
fbcb36cea1d4945e07432c84c518e327

SHA1
4b0d90179052a32afe8f39b550f9dd03a1b9c0e1

SHA256
34bc243b4fec3521f07df1bab3767e59c8f51dc147ad8524fdc13e00751d5f6b

SHA512
cf1310acf6c44ad4e19ac2d79dec3d19215fd2493ed168b5d22a4c26419fdafda73a657c7ddb3e4a174a583526d2caa4e4096fee09944bb3f871e9d3118d8c55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe

Filesize
468KB

MD5
cd14f606a188ae3e231b7fd202cc24f2

SHA1
146481f58a5652817f1849904067e5209e2775f0

SHA256
795e1d2c889dda66a65abc2a017e5959c368ae75da949dc81da3df8aac42eea5

SHA512
f907eac52f23cfa34761d2af4e465cfeb47208d9333f94ee10c4acebf5124ef72c359186629441e6ddb032b5c2688e310527f64b9a395f1f5b8b47b6c5e0d1a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17861.exe

Filesize
468KB

MD5
e924779120ce31f179f9fb303006bb93

SHA1
0422f754bbf00825266160807bc44154f8673cb6

SHA256
79be1a27653a286e513cf1ec29e7077d52b8bdab8504b794ce5dd59f5cbb4f0d

SHA512
61c1da65c0f528bf3486832cb184a55ca90a78e49ee2699ce5e961909b64dc4122e48927cc382b21b972f9f078f2e7343708585bedca7f4d601338a65acd5bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18450.exe

Filesize
468KB

MD5
a06ef50ec6bf74d10a230c665585de14

SHA1
7ebe6392e3037a9e61d92e45501e7b893eb523ce

SHA256
79de4fd2c11961d0738ebbe4ca2170f80caa5a4110b698f23ff35e88542aa277

SHA512
cf71eeb4153c9cb961c2e2494e81a105487645df74f1ada92b64c2912b071eb54376be124ad7c7819d341228e614fbbb4ec75f19ae1d9d3371ff5f282952a691

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe

Filesize
468KB

MD5
4ee8c94168ecbc23bbcc975a856677c7

SHA1
3ca7e620df24776daa915b966717c3712083df46

SHA256
5727ae9f1f587e10b4b6ba2d33bc3006b01ca52be08a519efe7a470ffe5d685a

SHA512
78ffe4d4a2be59dc6ea05200e87913d0d50511248d2e67a4b3d161118de8b690058a27d7e977cdc7d7d4170ea20d4c567261effcfa3447594c1960fbfa068585

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20173.exe

Filesize
468KB

MD5
cb1a0f93e700b659185287fb8c8ca85a

SHA1
164fcebda875d2f4b0480b1795e07b351db22fc8

SHA256
5f1489917e514836a454ca5a5988e5072573f94587531643e5312c8ce77e5d07

SHA512
a50ec155fae8b2bb5176ef6aa2070bacec2d9bcbf564234dade55ef3c5b9ee1b99d6c44fef0eb59774b441a0f9aab9a02aa87936a14eb1e98fb03ada186d2c74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20282.exe

Filesize
468KB

MD5
508c76ce789ea645557058c2a553c52d

SHA1
97efbe8b935bbd4ebfb777551e6cde4ec2f97e37

SHA256
48224e5634f5b8bf74ea39c28820378a784b594adc5753aae28db7b020bb016c

SHA512
1076d74ab17f7f0045645276c0def71a50da89d95f4e76874203c4fb310d5840618168cb354315603b1902d2164fb4d7101119b7e1f5cb7c6735c902580bedeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21597.exe

Filesize
468KB

MD5
f124f52911b01473d53cbcb758976e50

SHA1
b7e1cd1a9a754d65f917e4dcedabe91e7b94c331

SHA256
b3c169b707f97788b69d13cad20ba6d4b0e7e22093c390bb7e39a0c226236af4

SHA512
0ad2d983b40338d9cee90f02f619f55b0c434355c100e4772a53444cd74c7eaa894a9f078adea39e4860c4198793a606b64d1d7272f238aa5e6619cc84447095

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26037.exe

Filesize
468KB

MD5
f127003e110a5e9d0cbe8ee0f0eba8b9

SHA1
60a9a3891c1e20d6465525ba2972d1d59dc8312d

SHA256
a835dac5dbd4ab667d52686d74acde392596f3ec03b11ea9bbc68632b1df55cb

SHA512
e2231b9e948846c182f5da567be0d510613343c90a0fc4e167e5f0bb1a871b29691af8cb4c23797a11083400d2f604e11260955e3103b037db8c10226de964e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exe

Filesize
468KB

MD5
6f24af54e63739634ae7b3bab26c86df

SHA1
25b1bf4853f41393acf633f229b1d5a76632a5c8

SHA256
66301f62db7a6ee95e109d4ae2c13817a83b4befcf764674807536678b31c37a

SHA512
c0ed32e44c1947a1aca660307e4a01742b9438ebd0b3233f5b71347ae8387810b249fd7d5113e441fd0a649d24c2e027a9bb6a6cfbf447e60ffbaeaf0de8f1f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe

Filesize
468KB

MD5
2606936de4a594b73d1037b672b57fbe

SHA1
7f828c37c9614b7403e91b1b839bb1922646059e

SHA256
28a03a1353fb81e4236e335e3d6756ddb9b702a142a88d0e7fe03182893c0b1b

SHA512
87664a0270f5189bc99276188c98005513a09f2267cc79b5d44597e68410075ca7c4978964bd4b4640a06951e1669a4f28130386fe9eaa3f0b1e0d86ce71ed67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29418.exe

Filesize
468KB

MD5
8c30ac1c9e64486aaaee33acb508af84

SHA1
3dfd5b56dcdb5e96a4fd84862f54457ba509c9c4

SHA256
f3b196c1f597f5e1c4f62de62d50f522ff0b4004bade338e0f211d697f6bd7da

SHA512
7b7e07cd49e5a04a51bb358d39de4f4f7e82a1ff03bcc213b5d123bfc01b3c20fd71740fab81e965dbdf40b86c0c07e7b196aa67292cdd12fa34b56bd9a8df5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30186.exe

Filesize
468KB

MD5
fb0baaf41ef211d619d9f1d2244a4447

SHA1
e14b41f6b05f56b100c6056a9ec6acdf8b871fef

SHA256
77c94be2a4ea33e3af3606701a0c2637fc1ab882540cc5dd616920fb23a21aa4

SHA512
96236bf205c518657d202fb6a3b50eb7402013debe6175ccacca46d63415f7f6923b8de9118c814a35f20e93ea3e75644eee4249831e25b04e9a131edfa26981

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30475.exe

Filesize
468KB

MD5
c3937e8cbe5ae1da9cecccb86c221c50

SHA1
3c89981ccbf3340ae5177523e731dabf00d5e959

SHA256
7c97766dbeb8a05f8cf20934f9e70d29ee9939a5bcc8019003bb7644212f152b

SHA512
102187e911011e9b0bb26ed1c4af8095d87ba0acc688c2d6a7a9dca664718e2899bb3c05956e0a7d24a1e53eedec29ed623d455b33cabd98aa07eebdca45cd24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32277.exe

Filesize
468KB

MD5
0f57fe31e2f0604f2e84ef37c06a2337

SHA1
83230382fdbcaef2d0f1cda13b8b68f15625d7e5

SHA256
54684652ec0ba28e5e9f97a03308f23a84ab371309279f60a39eb7993fc43533

SHA512
de310b3eafa271b671f3be793df641388b5926aa548417e39611d4f15e08b5b69dd64b47ed167432f6fbf471fe8fd82213415bc3d331dffd18e84e1c9d678510

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32557.exe

Filesize
468KB

MD5
e80fa7294e5b621014b0a022afc4cbd5

SHA1
4c2738c84b1206712e459d90ef748f6146485370

SHA256
45297b1c5ea8a60831bb48a854098ed8213ec11fdac0b56c6bac87371b9091f6

SHA512
f4f1bd32d64c43e2b9d9b7264e0d99271d93a23e8d04dc479df34d3bf5f234602b14909601a95a10936a9a17f7e9a18cb538e5436cac0952b1e99e8fade180ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe

Filesize
468KB

MD5
bf6223e5e81b7d6d0cdeb91b469f98d9

SHA1
4238526d1e03fd8178bf1631c9d69e105fbff151

SHA256
c94f896c2e705eb5986f61a07a139f383cff4c01ebbe601a81075bd3c8a66fb4

SHA512
abe0a7bdaf54c1c0ea78a8b93a98a26c2e4a4a2a93cd93525acc2816961c5abeb09f0666203f3aa7cb01b028f6175f09b6ffb2336af39574fd379b88eb210e3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35284.exe

Filesize
468KB

MD5
d65d540fe4e694bff382a8a384655d5a

SHA1
d4104de0b7100ee2f64f22b22f32d65443bb7316

SHA256
efb70a699a478108d74adc974e4f7a879159eccad55e345a03a84a9ffb1bae8f

SHA512
ed78d42162f8362b7236a160c2e64e2b9fc07b889b6f299c3177ee33a15cd45d57f2c1d20441852423d6419ac8c92703b3b4ede98aa4bdadfe02025b5047cb46

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35549.exe

Filesize
468KB

MD5
a5cc34200304fbe9c492d86e29fd1387

SHA1
6830dc9d916b97cde532d69ce73a81a53bda8e2f

SHA256
edc1fa2123cc93b592122eaff6ae7f9693f25e534f4454330b63abf0519dac6c

SHA512
fac5bff491e4cd3f6d4e2ff8aa8ec7832b71efb0b341ca4ee64e2087a096c43d80ee82fa91f4b29fd41d6c289e724029ae73712d51a50b7f947164ee43a6fd94

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe

Filesize
468KB

MD5
309e7177f2f4ce6668a0ba5bfd0ac66b

SHA1
106f4c0da9c111224a1b75409ee5508f78a732e1

SHA256
ab34e479d99280f04bf6759680323e8745146d4f755ad41ec39ac2cd3141c552

SHA512
4aa5aa17a90fc5674cb3c46c09e9d23cdda11240e3f5c94f56538f4b8ab531c363ab82f3b0685f83eb568b6fb23d503bed7a6f586fae1d2d886d63ab50f2a6b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36701.exe

Filesize
468KB

MD5
a1721420db4965b72669cf09988b257b

SHA1
eb2a185b1d2c63380df56fb14846a336dbe6711f

SHA256
123f03d7bd0428d63825517bc842e3c97fe5cf1f872c3028a347c0b39220ffa4

SHA512
d4cede5722f42ec5c91e3239807db55358438b2507fbf7a8a64a558d325037fd99f83937dbf82a7a76173179aa7c474ed37038238366779a6ac7ec8018891ebb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37003.exe

Filesize
468KB

MD5
ffc1584647a1ddfc26651d10c320a240

SHA1
ded0fcf17dfa6082d29336600126a2f3df588a7d

SHA256
43eb610c81e2efb31129891aa220ce8805b637f1089908bc8a25e3013c2a0f50

SHA512
49d7d44368004d839e419505a5b0daeb9adb3a2e6ba9e58c6540228bcb524028a0db0660b62e17511b194d33c7b630aa774c768a46d0e20c77c32127a1d5be01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4004.exe

Filesize
468KB

MD5
e8059ffd0a38d5f90c57e0a75de05308

SHA1
d263be26d1080d6fcb0581c4fec0f721698bbb7b

SHA256
871a592777a415cc774c03e20dda2056cb4e3ad9308b2fe35544490e0faea432

SHA512
f5ebb4de04aa60ea43dd1317097db331e2f6bd27224e14267495b1a624f1cf02bd204e43f322c77c4dbea4d073c6bfc0e77f511327f0f42c87ba640407d06ab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4020.exe

Filesize
468KB

MD5
f7d9b360392bdfbb56dd3fa458bf0902

SHA1
d8b1b6253fc40db4d0627e0ad3937ea93e99e35a

SHA256
f83c25ab1bdebc6f75ad6beee9b554321529048468b4d5be0a3bd05153ae1ddf

SHA512
a0a0cf4f957f6290384185b2bae3ef78d766b7010cb6ad016ae760d80e0e7303173de53815a65e4d0d97c8697b4fd5658b6fb1744c11cf3c2509e9c3c2f12cba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe

Filesize
468KB

MD5
9572c46fb9d0066d0353130913ad5108

SHA1
f375e2b96233122f1fc7ed477aa4c0749c5e5bc8

SHA256
5d109e1bc422a2fd49754929d7ce14fac3adf83709e4ef08698488c1fcc2bd4f

SHA512
0d00f8a5f52fbb7a6101aaf570d4de2d08d15d1afc1262e8cf60c80f054d7b22dfb317afe09f776bbde3eba23d4f30d5f1cf3b1e874cb7ce1d66f90ff32ae3c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50739.exe

Filesize
468KB

MD5
b875669f8ebb2ae6b41ab358756d1256

SHA1
8085158f12b89626e0103a6000bef03f19930277

SHA256
1c062156b0d8a676e61d652c98d09648b4a4a5010710e984bb3033fe0ab50c53

SHA512
c8bf4d4d0ba10294bc32f92de2e8eacb2db23520c2ff793c1cf991027c0884840fe459e5f23b5b6e2ad234cd6eebb8be9c1a19b1d258e4d42bf31a1531f76d17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe

Filesize
468KB

MD5
70746fe69ff212b59fc3a5588870729f

SHA1
acf2bb4cf5af6f960066fdebe7a71e071c7c1403

SHA256
618b46faf96b166922e4fbb5c71a378135071030ff2bd1542318b19185eeecb2

SHA512
a24e1758aec08fa676d0fb644e3eca9b64d9da4810594c2ebef1cf8a931ab233802e5d8447f459d26715b13ea4a6a09bb6ae7105d20a605f8fb7d0d4992d08f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe

Filesize
468KB

MD5
7082be4773de4f3a8e5b6810e3446b03

SHA1
065589dd922d257a61f787daccc12e4d0d352314

SHA256
8fc114b9908d7d99cdab6d2e50672105a535fa5d36bdd0a23bad181ba6fd690b

SHA512
796d3f863d791162a5098508cf8f9acb2c86bb270d27cc9056eb3b91b53fd72b6c3d4691db786c77c6cbcd7562fc241f30c9113634aa56cc4abea3d8cdaaed4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55917.exe

Filesize
468KB

MD5
8b21853fe622ff493b85ded27c48912e

SHA1
fcaa5b91b407603229564bc983383bbc80e76fa0

SHA256
440193c622eb4bae45ac08bcc5a73c54eef27eb727b8c9508a38bf368b8a3f5b

SHA512
75c5b5b63074eaf1d52a43a39dfb47c1f9b955050abcbb62612ba231b1d01f6caecc1d7e7b8e25a50f3d5c1be42eb674a59f20159e40f2e0a1ed4d1524f8f950

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56332.exe

Filesize
468KB

MD5
8a4bf8ed7d222d5965798593ed6843bf

SHA1
a6cec8498816810c4c3ab37f40c54e108785694a

SHA256
a75ec60c6538bba5bff0f4b27881f2e9afc5051da718849a7f93238b93598ab0

SHA512
67cf40e0de28ac01c9ac75acfa394018512fcafceec336e8ab1ec0995ab3094805a6e47e583c8e52f5bfaba8346d7482f713200afcfbe6689db1ac4015870e37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe

Filesize
468KB

MD5
ee545802253cb2c15ac9ab7c5b68ea86

SHA1
1180c066067e4d0c4766414fb132e44a33c0ea07

SHA256
8184cc6172c2d5aa7988ce5ae9967e76c052dd923ffcf744e0d4e3ae07595d60

SHA512
3e018569672b9ad311d8514719a626ef7bc9890a34b05678d4d8bd5d4c5b4cb0761bcda1b7f340fd0318c591d7955d54b9c3c53bea84f5d99b6b417c27cee79e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59100.exe

Filesize
468KB

MD5
b4917ce4f416c1b5373710e4da57a212

SHA1
9bb0b6acd22d5edf0c391bba9d85d02390442f57

SHA256
d5272975a077b471dbeb2d36e38e238f4d7932b8697e10216884e4fbe74bc907

SHA512
c7acfea1ba7f4cb04c683b03de0658387788487118d353983dbe6ad01b140d73472ae35a892288965fc79d920170488e7e465d391cc049d4393a68148c065b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64884.exe

Filesize
468KB

MD5
ba8ef94ca088eb740b8280cb4b636df1

SHA1
4cdb2a918d93ad08ace220e51862bbff33ab81dd

SHA256
38bbae92f9632b6091c166c907b54e8063685f686ce6799dc75985b981a51453

SHA512
c202cf451e715d2a60b5fc9d2fe4f7bc724fc65ad229dfebfe85f4b4b72d95de7ff606a95d39d9c028113b21d5206c3794a6ec894cfb9fb8300129059dda9cfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6716.exe

Filesize
468KB

MD5
f69add2d48799d0835dce87137649052

SHA1
d7ff3242cd18850c368b292491bd7c5eaecf4290

SHA256
a88f672173b1f6b6af1ce1349b6d3ec34847363595ca5c19f314ddc21c236278

SHA512
75fc48fabc082cfddc9f1863d315ab961dfc857b5862fcd8a0796a197aba34bdb89ec88625d55df706b08d77247fbeb4e797e4a208854fe7c10f40725ddb8821

Download Submit
memory/208-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/224-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/428-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/436-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/540-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/648-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/852-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/888-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/924-571-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/936-15-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1160-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1192-580-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1204-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1208-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1264-572-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1496-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1544-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1620-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1720-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1740-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1792-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1796-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1800-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1840-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1900-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1916-570-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1940-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2092-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2272-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-2466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2484-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2776-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2908-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3076-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3108-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3212-2630-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3260-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3264-575-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3448-574-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3456-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3588-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3596-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3640-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3664-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3712-569-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3812-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3916-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4004-587-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4344-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4364-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4548-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4572-545-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4584-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4588-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4604-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4664-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4704-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4708-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4900-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4972-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5028-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5032-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5084-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5248-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5336-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5360-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5420-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5516-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5520-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5540-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5544-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5560-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5568-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5572-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5576-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5588-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5612-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5668-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5688-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5752-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5808-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5908-581-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6024-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6072-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6088-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6116-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6268-2716-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6368-2715-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15440-2504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15448-2484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads