482fff3c4ffe5752cde05a2242c11c8c848cf7bdd7d98a120936a70b850a488c

Analysis

max time kernel
120s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

482fff3c4ffe5752cde05a2242c11c8c848cf7bdd7d98a120936a70b850a488cN.exe
Size

468KB
MD5

48e795006d0ae1938b00c06db939e610
SHA1

5fa5553737cad4d6851a7165a6a919add6d8e047
SHA256

482fff3c4ffe5752cde05a2242c11c8c848cf7bdd7d98a120936a70b850a488c
SHA512

335ec739a1be847d103b21b6b37875aad13e1acae823d0a23a502d3b557116d27db0caf439372d5d7b7c6840475b981a069c6eeb9cdbc8d8613f54758729dd9c
SSDEEP

3072:tTzDog5dET882bYKWbi/8f8/3fdEtIpnndHesVpWN/j3m0HDz2lY:tTfotg82tWW/8fp0YnN/7/HDz

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3516	Unicorn-53641.exe
3404	Unicorn-28115.exe
3908	Unicorn-51228.exe
2204	Unicorn-49687.exe
968	Unicorn-29821.exe
1864	Unicorn-61939.exe
4708	Unicorn-55809.exe
744	Unicorn-4352.exe
1116	Unicorn-50024.exe
1420	Unicorn-55499.exe
4548	Unicorn-14558.exe
2252	Unicorn-32941.exe
3808	Unicorn-13075.exe
4996	Unicorn-32676.exe
1824	Unicorn-1975.exe
436	Unicorn-37985.exe
2100	Unicorn-15426.exe
3196	Unicorn-15426.exe
2740	Unicorn-11342.exe
4112	Unicorn-23330.exe
760	Unicorn-34455.exe
1764	Unicorn-65182.exe
3388	Unicorn-1804.exe
4008	Unicorn-61211.exe
5100	Unicorn-32531.exe
2376	Unicorn-20833.exe
2284	Unicorn-31768.exe
3220	Unicorn-40699.exe
3568	Unicorn-65295.exe
1868	Unicorn-39329.exe
1124	Unicorn-45451.exe
4696	Unicorn-20663.exe
3800	Unicorn-9733.exe
1040	Unicorn-50019.exe
2396	Unicorn-15763.exe
4836	Unicorn-25323.exe
2648	Unicorn-25323.exe
3120	Unicorn-62634.exe
4800	Unicorn-16963.exe
3076	Unicorn-12878.exe
2112	Unicorn-8764.exe
212	Unicorn-17429.exe
1904	Unicorn-63366.exe
1808	Unicorn-60673.exe
4372	Unicorn-62711.exe
4828	Unicorn-19641.exe
3944	Unicorn-62619.exe
3168	Unicorn-40061.exe
2660	Unicorn-4985.exe
2988	Unicorn-41237.exe
3372	Unicorn-46838.exe
4420	Unicorn-55006.exe
4456	Unicorn-21587.exe
2796	Unicorn-52313.exe
324	Unicorn-11372.exe
4920	Unicorn-1066.exe
3240	Unicorn-17887.exe
5012	Unicorn-40999.exe
4464	Unicorn-60865.exe
3636	Unicorn-25790.exe
4400	Unicorn-8156.exe
1016	Unicorn-61996.exe
5116	Unicorn-16325.exe
932	Unicorn-6110.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
4716	1904	WerFault.exe	131
8244	6652	WerFault.exe	242
10016	6288	WerFault.exe	254
19292	10736	WerFault.exe	494
7308	15312	WerFault.exe	709
8012	16132	WerFault.exe	826
10908	16560	WerFault.exe	843

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47178.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
18792	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	14616	dwm.exe
Token: SeChangeNotifyPrivilege	14616	dwm.exe
Token: 33	14616	dwm.exe
Token: SeIncBasePriorityPrivilege	14616	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1748	482fff3c4ffe5752cde05a2242c11c8c848cf7bdd7d98a120936a70b850a488cN.exe
3516	Unicorn-53641.exe
3404	Unicorn-28115.exe
3908	Unicorn-51228.exe
2204	Unicorn-49687.exe
968	Unicorn-29821.exe
1864	Unicorn-61939.exe
4708	Unicorn-55809.exe
1116	Unicorn-50024.exe
744	Unicorn-4352.exe
1420	Unicorn-55499.exe
2252	Unicorn-32941.exe
4548	Unicorn-14558.exe
4996	Unicorn-32676.exe
3808	Unicorn-13075.exe
1824	Unicorn-1975.exe
436	Unicorn-37985.exe
2100	Unicorn-15426.exe
3196	Unicorn-15426.exe
2740	Unicorn-11342.exe
4112	Unicorn-23330.exe
4008	Unicorn-61211.exe
5100	Unicorn-32531.exe
1764	Unicorn-65182.exe
3568	Unicorn-65295.exe
2376	Unicorn-20833.exe
760	Unicorn-34455.exe
3388	Unicorn-1804.exe
2284	Unicorn-31768.exe
3220	Unicorn-40699.exe
1868	Unicorn-39329.exe
1124	Unicorn-45451.exe
4696	Unicorn-20663.exe
3800	Unicorn-9733.exe
1040	Unicorn-50019.exe
2396	Unicorn-15763.exe
4836	Unicorn-25323.exe
2648	Unicorn-25323.exe
4800	Unicorn-16963.exe
3120	Unicorn-62634.exe
3076	Unicorn-12878.exe
212	Unicorn-17429.exe
1904	Unicorn-63366.exe
2112	Unicorn-8764.exe
1808	Unicorn-60673.exe
4372	Unicorn-62711.exe
4828	Unicorn-19641.exe
4420	Unicorn-55006.exe
2660	Unicorn-4985.exe
4456	Unicorn-21587.exe
3372	Unicorn-46838.exe
324	Unicorn-11372.exe
3944	Unicorn-62619.exe
3168	Unicorn-40061.exe
2796	Unicorn-52313.exe
4920	Unicorn-1066.exe
2988	Unicorn-41237.exe
3240	Unicorn-17887.exe
5012	Unicorn-40999.exe
4464	Unicorn-60865.exe
3636	Unicorn-25790.exe
4400	Unicorn-8156.exe
5116	Unicorn-16325.exe
1016	Unicorn-61996.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 3516	1748	482fff3c4ffe5752cde05a2242c11c8c848cf7bdd7d98a120936a70b850a488cN.exe	82
PID 1748 wrote to memory of 3516	1748	482fff3c4ffe5752cde05a2242c11c8c848cf7bdd7d98a120936a70b850a488cN.exe	82
PID 1748 wrote to memory of 3516	1748	482fff3c4ffe5752cde05a2242c11c8c848cf7bdd7d98a120936a70b850a488cN.exe	82
PID 3516 wrote to memory of 3404	3516	Unicorn-53641.exe	83
PID 3516 wrote to memory of 3404	3516	Unicorn-53641.exe	83
PID 3516 wrote to memory of 3404	3516	Unicorn-53641.exe	83
PID 1748 wrote to memory of 3908	1748	482fff3c4ffe5752cde05a2242c11c8c848cf7bdd7d98a120936a70b850a488cN.exe	84
PID 1748 wrote to memory of 3908	1748	482fff3c4ffe5752cde05a2242c11c8c848cf7bdd7d98a120936a70b850a488cN.exe	84
PID 1748 wrote to memory of 3908	1748	482fff3c4ffe5752cde05a2242c11c8c848cf7bdd7d98a120936a70b850a488cN.exe	84
PID 3404 wrote to memory of 2204	3404	Unicorn-28115.exe	87
PID 3404 wrote to memory of 2204	3404	Unicorn-28115.exe	87
PID 3404 wrote to memory of 2204	3404	Unicorn-28115.exe	87
PID 3516 wrote to memory of 968	3516	Unicorn-53641.exe	88
PID 3516 wrote to memory of 968	3516	Unicorn-53641.exe	88
PID 3516 wrote to memory of 968	3516	Unicorn-53641.exe	88
PID 3908 wrote to memory of 1864	3908	Unicorn-51228.exe	89
PID 3908 wrote to memory of 1864	3908	Unicorn-51228.exe	89
PID 3908 wrote to memory of 1864	3908	Unicorn-51228.exe	89
PID 1748 wrote to memory of 4708	1748	482fff3c4ffe5752cde05a2242c11c8c848cf7bdd7d98a120936a70b850a488cN.exe	90
PID 1748 wrote to memory of 4708	1748	482fff3c4ffe5752cde05a2242c11c8c848cf7bdd7d98a120936a70b850a488cN.exe	90
PID 1748 wrote to memory of 4708	1748	482fff3c4ffe5752cde05a2242c11c8c848cf7bdd7d98a120936a70b850a488cN.exe	90
PID 2204 wrote to memory of 744	2204	Unicorn-49687.exe	93
PID 2204 wrote to memory of 744	2204	Unicorn-49687.exe	93
PID 2204 wrote to memory of 744	2204	Unicorn-49687.exe	93
PID 3404 wrote to memory of 1116	3404	Unicorn-28115.exe	94
PID 3404 wrote to memory of 1116	3404	Unicorn-28115.exe	94
PID 3404 wrote to memory of 1116	3404	Unicorn-28115.exe	94
PID 968 wrote to memory of 1420	968	Unicorn-29821.exe	95
PID 968 wrote to memory of 1420	968	Unicorn-29821.exe	95
PID 968 wrote to memory of 1420	968	Unicorn-29821.exe	95
PID 3516 wrote to memory of 4548	3516	Unicorn-53641.exe	96
PID 3516 wrote to memory of 4548	3516	Unicorn-53641.exe	96
PID 3516 wrote to memory of 4548	3516	Unicorn-53641.exe	96
PID 1864 wrote to memory of 2252	1864	Unicorn-61939.exe	97
PID 1864 wrote to memory of 2252	1864	Unicorn-61939.exe	97
PID 1864 wrote to memory of 2252	1864	Unicorn-61939.exe	97
PID 3908 wrote to memory of 3808	3908	Unicorn-51228.exe	98
PID 3908 wrote to memory of 3808	3908	Unicorn-51228.exe	98
PID 3908 wrote to memory of 3808	3908	Unicorn-51228.exe	98
PID 1748 wrote to memory of 4996	1748	482fff3c4ffe5752cde05a2242c11c8c848cf7bdd7d98a120936a70b850a488cN.exe	99
PID 1748 wrote to memory of 4996	1748	482fff3c4ffe5752cde05a2242c11c8c848cf7bdd7d98a120936a70b850a488cN.exe	99
PID 1748 wrote to memory of 4996	1748	482fff3c4ffe5752cde05a2242c11c8c848cf7bdd7d98a120936a70b850a488cN.exe	99
PID 4708 wrote to memory of 1824	4708	Unicorn-55809.exe	101
PID 4708 wrote to memory of 1824	4708	Unicorn-55809.exe	101
PID 4708 wrote to memory of 1824	4708	Unicorn-55809.exe	101
PID 744 wrote to memory of 436	744	Unicorn-4352.exe	104
PID 744 wrote to memory of 436	744	Unicorn-4352.exe	104
PID 744 wrote to memory of 436	744	Unicorn-4352.exe	104
PID 4548 wrote to memory of 2100	4548	Unicorn-14558.exe	105
PID 4548 wrote to memory of 2100	4548	Unicorn-14558.exe	105
PID 4548 wrote to memory of 2100	4548	Unicorn-14558.exe	105
PID 1116 wrote to memory of 3196	1116	Unicorn-50024.exe	106
PID 1116 wrote to memory of 3196	1116	Unicorn-50024.exe	106
PID 1116 wrote to memory of 3196	1116	Unicorn-50024.exe	106
PID 1420 wrote to memory of 2740	1420	Unicorn-55499.exe	107
PID 1420 wrote to memory of 2740	1420	Unicorn-55499.exe	107
PID 1420 wrote to memory of 2740	1420	Unicorn-55499.exe	107
PID 3516 wrote to memory of 4112	3516	Unicorn-53641.exe	108
PID 3516 wrote to memory of 4112	3516	Unicorn-53641.exe	108
PID 3516 wrote to memory of 4112	3516	Unicorn-53641.exe	108
PID 2204 wrote to memory of 760	2204	Unicorn-49687.exe	109
PID 2204 wrote to memory of 760	2204	Unicorn-49687.exe	109
PID 2204 wrote to memory of 760	2204	Unicorn-49687.exe	109
PID 968 wrote to memory of 1764	968	Unicorn-29821.exe	110

C:\Users\Admin\AppData\Local\Temp\482fff3c4ffe5752cde05a2242c11c8c848cf7bdd7d98a120936a70b850a488cN.exe
"C:\Users\Admin\AppData\Local\Temp\482fff3c4ffe5752cde05a2242c11c8c848cf7bdd7d98a120936a70b850a488cN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53641.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53641.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49687.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4352.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8156.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44119.exe
        9⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        10⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12030.exe
        11⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34859.exe
        12⤵
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15979.exe
        11⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        11⤵
        
        PID:18392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        10⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33004.exe
        10⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47554.exe
        9⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44743.exe
        9⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19575.exe
        9⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52842.exe
        8⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12188.exe
        9⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60411.exe
        10⤵
        
        PID:17696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42875.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe
        9⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3186.exe
        8⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58403.exe
        9⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14744.exe
        9⤵
        
        PID:18532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30764.exe
        8⤵
        
        PID:11488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56399.exe
        8⤵
        
        PID:17860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61996.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3086.exe
        8⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe
        9⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64433.exe
        10⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        10⤵
        
        PID:18452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
        9⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe
        9⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24786.exe
        8⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52763.exe
        8⤵
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30363.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17376.exe
        7⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35925.exe
        8⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3068.exe
        9⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        9⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48970.exe
        9⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15081.exe
        8⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        8⤵
        
        PID:15928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38559.exe
        8⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        8⤵
        
        PID:18512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
        7⤵
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3996.exe
        7⤵
        
        PID:16172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9733.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16325.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11254.exe
        8⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42915.exe
        9⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        10⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        9⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34130.exe
        9⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        8⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        9⤵
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        9⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47624.exe
        9⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37151.exe
        8⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48159.exe
        8⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe
        8⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42535.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3828.exe
        8⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3172.exe
        9⤵
        
        PID:12968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14744.exe
        9⤵
        
        PID:18540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        8⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22778.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58465.exe
        8⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56768.exe
        8⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe
        7⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20531.exe
        7⤵
        
        PID:16120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        6⤵
        Executes dropped EXE
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38063.exe
        8⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe
        9⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25657.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22568.exe
        8⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
        8⤵
        
        PID:18220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24786.exe
        7⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31861.exe
        7⤵
        
        PID:15492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
        6⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9474.exe
        7⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53141.exe
        8⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        8⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        7⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48159.exe
        7⤵
        
        PID:18356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64433.exe
        7⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        7⤵
        
        PID:440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52242.exe
        6⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
        6⤵
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13008.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
        8⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        9⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17681.exe
        9⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25319.exe
        9⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        8⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        8⤵
        
        PID:15904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27133.exe
        7⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52949.exe
        8⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15578.exe
        7⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37474.exe
        7⤵
        
        PID:15076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56542.exe
        6⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        7⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3670.exe
        8⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3556.exe
        9⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        9⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
        8⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        8⤵
        
        PID:17500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34157.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        8⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49699.exe
        8⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46819.exe
        7⤵
        
        PID:13840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61289.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8284.exe
        6⤵
        
        PID:12076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        6⤵
        
        PID:18428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1066.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45442.exe
        6⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40777.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        8⤵
        
        PID:13912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20701.exe
        7⤵
        
        PID:11288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60411.exe
        7⤵
        
        PID:17680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        6⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        6⤵
        
        PID:11436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57769.exe
        6⤵
        
        PID:18344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
        5⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe
        6⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
        7⤵
        
        PID:13704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61350.exe
        6⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16794.exe
        6⤵
        
        PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18860.exe
        5⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42321.exe
        6⤵
        
        PID:11212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        6⤵
        
        PID:15700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5563.exe
        5⤵
        
        PID:11304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9297.exe
        5⤵
        
        PID:18164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50024.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25323.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3880.exe
        7⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        8⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe
        9⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        10⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
        10⤵
        
        PID:17868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11189.exe
        9⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        9⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39769.exe
        8⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6040.exe
        8⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        8⤵
        
        PID:17880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14331.exe
        7⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3828.exe
        8⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        9⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        9⤵
        
        PID:15092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16176.exe
        9⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9051.exe
        8⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49421.exe
        7⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe
        7⤵
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20531.exe
        7⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        6⤵
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52671.exe
        7⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9290.exe
        9⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27651.exe
        10⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe
        9⤵
        
        PID:17832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56114.exe
        8⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51480.exe
        8⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
        7⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6040.exe
        7⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        7⤵
        
        PID:18144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16609.exe
        6⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22699.exe
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18676.exe
        7⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
        7⤵
        
        PID:18188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55617.exe
        6⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17815.exe
        6⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe
        6⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63366.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1904
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 724
        6⤵
        Program crash
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-656.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
        6⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16473.exe
        7⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62357.exe
        7⤵
        
        PID:17800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        6⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        6⤵
        
        PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36428.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52155.exe
        6⤵
        
        PID:14472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5045.exe
        6⤵
        
        PID:15108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64501.exe
        5⤵
        
        PID:11144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59912.exe
        5⤵
        
        PID:14328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12878.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12624.exe
        6⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25837.exe
        7⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62567.exe
        8⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39031.exe
        9⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51532.exe
        9⤵
        
        PID:14856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        8⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        8⤵
        
        PID:18276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17211.exe
        7⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6040.exe
        7⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        7⤵
        
        PID:17792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        7⤵
        
        PID:10932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53994.exe
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44604.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58417.exe
        6⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55268.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        6⤵
        
        PID:18172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        5⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42915.exe
        6⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        7⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        7⤵
        
        PID:15888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17219.exe
        6⤵
        
        PID:9696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        6⤵
        
        PID:14648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe
        6⤵
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61414.exe
        6⤵
        
        PID:8464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58417.exe
        5⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27651.exe
        6⤵
        
        PID:13672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2430.exe
        6⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55268.exe
        5⤵
        
        PID:11648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38622.exe
        5⤵
        
        PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17429.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22739.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8130.exe
        6⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
        7⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe
        7⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-909.exe
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        6⤵
        
        PID:11588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
        6⤵
        
        PID:18384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22857.exe
        5⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-816.exe
        6⤵
        
        PID:14732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
        6⤵
        
        PID:16532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59735.exe
        5⤵
        
        PID:10604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45450.exe
        5⤵
        
        PID:15296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26636.exe
      4⤵
      PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        6⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
        5⤵
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64307.exe
        5⤵
        
        PID:14684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe
        5⤵
        
        PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61414.exe
        5⤵
        
        PID:8376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exe
      4⤵
      PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        5⤵
        
        PID:15304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18010.exe
      4⤵
      PID:11244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe
      4⤵
      PID:2196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55499.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11342.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25323.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        7⤵
        
        PID:60
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        9⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
        10⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49699.exe
        10⤵
        
        PID:13388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50660.exe
        9⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        9⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe
        8⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34537.exe
        9⤵
        
        PID:10644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20395.exe
        9⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6040.exe
        8⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        8⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30667.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61389.exe
        8⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        9⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14744.exe
        9⤵
        
        PID:18564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30623.exe
        8⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51645.exe
        8⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23634.exe
        7⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41169.exe
        8⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46488.exe
        8⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29086.exe
        8⤵
        
        PID:14764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17054.exe
        7⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30363.exe
        7⤵
        
        PID:14332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47554.exe
        7⤵
        
        PID:8596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        6⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        8⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29829.exe
        8⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16062.exe
        8⤵
        
        PID:18152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
        7⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        7⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
        6⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61389.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34153.exe
        8⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe
        8⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37572.exe
        8⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        7⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9051.exe
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22098.exe
        6⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22086.exe
        6⤵
        
        PID:15180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12935.exe
        6⤵
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62634.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12624.exe
        6⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48395.exe
        7⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        8⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe
        9⤵
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
        9⤵
        
        PID:14792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50660.exe
        8⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25002.exe
        8⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27901.exe
        7⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34628.exe
        7⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        7⤵
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58462.exe
        6⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
        7⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64433.exe
        8⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        8⤵
        
        PID:18476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46166.exe
        7⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        7⤵
        
        PID:18308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24950.exe
        6⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        6⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        6⤵
        
        PID:18300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32944.exe
        5⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        6⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60676.exe
        7⤵
        
        PID:17884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28434.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31330.exe
        6⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46824.exe
        6⤵
        
        PID:9140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10771.exe
        5⤵
        
        PID:6288
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6288 -s 632
        6⤵
        Program crash
        
        PID:10016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
        5⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44971.exe
        5⤵
        
        PID:14716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51705.exe
        5⤵
        
        PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65182.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53465.exe
        6⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15915.exe
        7⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10626.exe
        8⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        9⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36046.exe
        9⤵
        
        PID:14404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64064.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49398.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe
        8⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27280.exe
        7⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe
        7⤵
        
        PID:13956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19759.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10904.exe
        8⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37665.exe
        7⤵
        
        PID:13568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14365.exe
        6⤵
        
        PID:14152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63744.exe
        6⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11617.exe
        5⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8130.exe
        6⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44604.exe
        7⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48.exe
        8⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22228.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44682.exe
        6⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56457.exe
        7⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14744.exe
        7⤵
        
        PID:18548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49403.exe
        6⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48159.exe
        6⤵
        
        PID:18372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36593.exe
        5⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59861.exe
        6⤵
        
        PID:224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36784.exe
        5⤵
        
        PID:13396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62711.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53465.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49931.exe
        6⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59259.exe
        7⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
        7⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62720.exe
        6⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        6⤵
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31217.exe
        5⤵
        
        PID:8116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15578.exe
        5⤵
        
        PID:10484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10831.exe
        5⤵
        
        PID:15216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63744.exe
        5⤵
        
        PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27134.exe
      4⤵
      PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18437.exe
        5⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63369.exe
        6⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17153.exe
        7⤵
        
        PID:13676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3727.exe
        6⤵
        
        PID:13104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        6⤵
        
        PID:18244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9845.exe
        5⤵
        
        PID:9356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
        6⤵
        
        PID:13680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8500.exe
        5⤵
        
        PID:14220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53253.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        5⤵
        
        PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41827.exe
        5⤵
        
        PID:12880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3451.exe
      4⤵
      PID:9544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56624.exe
      4⤵
      PID:14412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14558.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50019.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6018.exe
        6⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32251.exe
        7⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        8⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        9⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19483.exe
        10⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        10⤵
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55263.exe
        9⤵
        
        PID:15764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53400.exe
        8⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        8⤵
        
        PID:14704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57894.exe
        8⤵
        
        PID:15096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24786.exe
        7⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        8⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        8⤵
        
        PID:18444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31861.exe
        7⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14331.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        7⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe
        8⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        8⤵
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64344.exe
        8⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        7⤵
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        7⤵
        
        PID:14872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
        6⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        6⤵
        
        PID:17720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47606.exe
        5⤵
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9692.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64739.exe
        7⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27137.exe
        8⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51693.exe
        8⤵
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50784.exe
        8⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11163.exe
        7⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        7⤵
        
        PID:18180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15299.exe
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64525.exe
        6⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
        6⤵
        
        PID:18236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62722.exe
        6⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        5⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20933.exe
        6⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8024.exe
        7⤵
        
        PID:13752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31391.exe
        6⤵
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-197.exe
        6⤵
        
        PID:15832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31994.exe
        5⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        6⤵
        
        PID:15328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        5⤵
        
        PID:11932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14110.exe
        5⤵
        
        PID:16380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15763.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48997.exe
        5⤵
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6978.exe
        6⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35925.exe
        7⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63535.exe
        8⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        9⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15294.exe
        8⤵
        
        PID:17708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        7⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29197.exe
        7⤵
        
        PID:16248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24786.exe
        6⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1965.exe
        6⤵
        
        PID:17744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55364.exe
        5⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        6⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3426.exe
        7⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33357.exe
        7⤵
        
        PID:17656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exe
        6⤵
        
        PID:10520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        6⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28471.exe
        6⤵
        
        PID:8308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
        5⤵
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54702.exe
        5⤵
        
        PID:14136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38783.exe
      4⤵
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54809.exe
        5⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3828.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17319.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
        7⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        6⤵
        
        PID:18336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24786.exe
        5⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31861.exe
        5⤵
        
        PID:16496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
      4⤵
      PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54783.exe
        5⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe
        6⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37665.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        5⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        5⤵
        
        PID:15084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7511.exe
        5⤵
        
        PID:16004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28146.exe
      4⤵
      PID:8088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28995.exe
        5⤵
        
        PID:14940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52242.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21061.exe
      4⤵
      PID:16200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33615.exe
      4⤵
      PID:8296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23330.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16963.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39267.exe
        5⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11638.exe
        6⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64739.exe
        7⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25513.exe
        8⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        8⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30213.exe
        7⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        7⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26102.exe
        6⤵
        
        PID:9584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43530.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46899.exe
        6⤵
        
        PID:14388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38835.exe
        5⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3828.exe
        6⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        7⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64936.exe
        7⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60130.exe
        7⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        6⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10736 -s 464
        7⤵
        Program crash
        
        PID:19292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4774.exe
        6⤵
        
        PID:13160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10330.exe
        5⤵
        
        PID:15516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17263.exe
      4⤵
      PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28935.exe
        5⤵
        
        PID:6652
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 488
        6⤵
        Program crash
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18013.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39499.exe
        5⤵
        
        PID:15636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe
      4⤵
      PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20967.exe
        5⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        5⤵
        
        PID:15896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34106.exe
      4⤵
      PID:8900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51168.exe
      4⤵
      PID:15224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8764.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53465.exe
      4⤵
      PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46641.exe
        5⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42181.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50250.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23331.exe
        6⤵
        
        PID:16268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11215.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64525.exe
        5⤵
        
        PID:13240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
        5⤵
        
        PID:18284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28119.exe
      4⤵
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22337.exe
        5⤵
        
        PID:8840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
        6⤵
        
        PID:13600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14744.exe
        6⤵
        
        PID:18556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14951.exe
        6⤵
        
        PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34453.exe
        5⤵
        
        PID:13124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42294.exe
        5⤵
        
        PID:18404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52169.exe
      4⤵
      PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10162.exe
        5⤵
        
        PID:13556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        5⤵
        
        PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61428.exe
      4⤵
      PID:14308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10101.exe
    3⤵
    PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35925.exe
      4⤵
      PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe
        5⤵
        
        PID:11092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17489.exe
        5⤵
        
        PID:15124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13213.exe
      4⤵
      PID:12812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
      4⤵
      PID:1276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28677.exe
    3⤵
    PID:8080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47776.exe
    3⤵
    PID:12068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59732.exe
    3⤵
    PID:16132
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 16132 -s 464
      4⤵
      Program crash
      PID:8012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61939.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43906.exe
        6⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2292.exe
        7⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        8⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44973.exe
        9⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        9⤵
        
        PID:18520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31199.exe
        8⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16062.exe
        8⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60236.exe
        8⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12393.exe
        7⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33642.exe
        7⤵
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47287.exe
        7⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45747.exe
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26011.exe
        7⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52518.exe
        7⤵
        
        PID:13980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3955.exe
        6⤵
        
        PID:10180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14795.exe
        6⤵
        
        PID:15476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46838.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13008.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35925.exe
        7⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50681.exe
        8⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20395.exe
        8⤵
        
        PID:15504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43986.exe
        8⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
        7⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        7⤵
        
        PID:15344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24786.exe
        6⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5700.exe
        6⤵
        
        PID:14212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe
        6⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4740.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        6⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24475.exe
        7⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        8⤵
        
        PID:13032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63369.exe
        8⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3727.exe
        7⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        7⤵
        
        PID:18204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5761.exe
        6⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        7⤵
        
        PID:15664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39499.exe
        6⤵
        
        PID:15624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1617.exe
        5⤵
        
        PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41943.exe
        5⤵
        
        PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59912.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20833.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49765.exe
        6⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27757.exe
        7⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe
        8⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31224.exe
        8⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        7⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        7⤵
        
        PID:15864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17768.exe
        6⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        7⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24926.exe
        6⤵
        
        PID:12436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe
        6⤵
        
        PID:9604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8898.exe
        6⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64521.exe
        7⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe
        8⤵
        
        PID:12864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58470.exe
        7⤵
        
        PID:15436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39494.exe
        6⤵
        
        PID:18328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26478.exe
        5⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        6⤵
        
        PID:13736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58776.exe
        5⤵
        
        PID:10728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
        5⤵
        
        PID:17840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11372.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14954.exe
        5⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
        6⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        7⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48330.exe
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        6⤵
        
        PID:11668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27133.exe
        5⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59534.exe
        6⤵
        
        PID:12964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42294.exe
        6⤵
        
        PID:17520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15578.exe
        5⤵
        
        PID:10448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        5⤵
        
        PID:17648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53584.exe
      4⤵
      PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        5⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63831.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51999.exe
        6⤵
        
        PID:15824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41915.exe
        5⤵
        
        PID:10580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58489.exe
      4⤵
      PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        5⤵
        
        PID:10412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56134.exe
      4⤵
      PID:10144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11440.exe
      4⤵
      PID:14592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13075.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40699.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40061.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64155.exe
        6⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27757.exe
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        8⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        8⤵
        
        PID:15920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
        7⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41174.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24786.exe
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exe
        6⤵
        
        PID:15644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56542.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49931.exe
        6⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        7⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55263.exe
        7⤵
        
        PID:15756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53400.exe
        6⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30557.exe
        6⤵
        
        PID:17668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
        5⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1610.exe
        6⤵
        
        PID:12820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50131.exe
        6⤵
        
        PID:18808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7629.exe
        5⤵
        
        PID:11156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10910.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55006.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        5⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23289.exe
        6⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63727.exe
        7⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48159.exe
        7⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44246.exe
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        6⤵
        
        PID:15100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39494.exe
        6⤵
        
        PID:17608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4575.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28406.exe
        5⤵
        
        PID:11012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        5⤵
        
        PID:15912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43635.exe
      4⤵
      PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46231.exe
        5⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10660.exe
        6⤵
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
        6⤵
        
        PID:15672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
        5⤵
        
        PID:9376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52055.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6363.exe
        5⤵
        
        PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40994.exe
        5⤵
        
        PID:7888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55286.exe
      4⤵
      PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        5⤵
        
        PID:9176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
      4⤵
      PID:13292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52411.exe
      4⤵
      PID:10680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19641.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45442.exe
        5⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe
        6⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        7⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60302.exe
        7⤵
        
        PID:14232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21303.exe
        6⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31060.exe
        6⤵
        
        PID:13760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8065.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42265.exe
        5⤵
        
        PID:13372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57769.exe
        5⤵
        
        PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9967.exe
        5⤵
        
        PID:9892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56542.exe
      4⤵
      PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe
        6⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27603.exe
        6⤵
        
        PID:14708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        5⤵
        
        PID:12740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        5⤵
        
        PID:14824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61289.exe
      4⤵
      PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38559.exe
        5⤵
        
        PID:9924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        5⤵
        
        PID:18460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50608.exe
      4⤵
      PID:10088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6430.exe
      4⤵
      PID:17752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4985.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
      4⤵
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34773.exe
        5⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13592.exe
        6⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe
        6⤵
        
        PID:13268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
        6⤵
        
        PID:18364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46550.exe
        5⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52155.exe
        6⤵
        
        PID:14460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7183.exe
        6⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61699.exe
        5⤵
        
        PID:14340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30363.exe
        5⤵
        
        PID:12368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22857.exe
      4⤵
      PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-494.exe
        5⤵
        
        PID:12284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28558.exe
        5⤵
        
        PID:468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4548.exe
      4⤵
      PID:12804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57769.exe
      4⤵
      PID:4776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe
    3⤵
    PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
      4⤵
      PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe
        5⤵
        
        PID:9040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51746.exe
        5⤵
        
        PID:17784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18589.exe
      4⤵
      PID:9244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39494.exe
      4⤵
      PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26342.exe
      4⤵
      PID:10216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exe
    3⤵
    PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63831.exe
      4⤵
      PID:14056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26137.exe
    3⤵
    PID:11068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27356.exe
    3⤵
    PID:17808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55809.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55809.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1975.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39329.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17887.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        6⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58099.exe
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe
        8⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18523.exe
        9⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30369.exe
        8⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        8⤵
        
        PID:18316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        7⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55563.exe
        7⤵
        
        PID:12844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16827.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
        7⤵
        
        PID:13696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1764.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19575.exe
        6⤵
        
        PID:15400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15509.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26003.exe
        6⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        7⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34043.exe
        7⤵
        
        PID:13952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13213.exe
        6⤵
        
        PID:12788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        6⤵
        
        PID:18260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56877.exe
        6⤵
        
        PID:10688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        5⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48.exe
        6⤵
        
        PID:13652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe
        5⤵
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6430.exe
        5⤵
        
        PID:17764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20657.exe
        5⤵
        
        PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40999.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46231.exe
        6⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54407.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22965.exe
        7⤵
        
        PID:17772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9051.exe
        6⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64307.exe
        6⤵
        
        PID:14568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        6⤵
        
        PID:14468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27517.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        6⤵
        
        PID:14984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6040.exe
        5⤵
        
        PID:11972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29197.exe
        5⤵
        
        PID:16240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17568.exe
      4⤵
      PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
        5⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55201.exe
        6⤵
        
        PID:8904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42621.exe
        6⤵
        
        PID:13196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        6⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1677.exe
        5⤵
        
        PID:9300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
      4⤵
      PID:12040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3996.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54544.exe
      4⤵
      PID:7504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45451.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60865.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exe
        5⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42915.exe
        6⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11314.exe
        7⤵
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        7⤵
        
        PID:14296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        6⤵
        
        PID:10496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42294.exe
        6⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44682.exe
        5⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57863.exe
        6⤵
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9596.exe
        6⤵
        
        PID:16140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40048.exe
        5⤵
        
        PID:11284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        5⤵
        
        PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46812.exe
      4⤵
      PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3252.exe
        5⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3172.exe
        6⤵
        
        PID:12984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59861.exe
        6⤵
        
        PID:18468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        5⤵
        
        PID:12752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        5⤵
        
        PID:18252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
      4⤵
      PID:8736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36227.exe
      4⤵
      PID:14320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25790.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exe
      4⤵
      PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42915.exe
        5⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61734.exe
        5⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54058.exe
        5⤵
        
        PID:16192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24758.exe
      4⤵
      PID:8112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48216.exe
      4⤵
      PID:12712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
      4⤵
      PID:3676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57747.exe
    3⤵
    PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27757.exe
      4⤵
      PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56088.exe
        5⤵
        
        PID:11732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42294.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        5⤵
        
        PID:7644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36461.exe
      4⤵
      PID:10464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
      4⤵
      PID:15312
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15312 -s 472
        5⤵
        Program crash
        
        PID:7308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
    3⤵
    PID:8068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3426.exe
      4⤵
      PID:11260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39855.exe
      4⤵
      PID:14960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
    3⤵
    PID:11892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52047.exe
    3⤵
    PID:16016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32676.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32676.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62619.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        6⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64433.exe
        7⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        7⤵
        
        PID:17864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4548.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57769.exe
        6⤵
        
        PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        5⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        6⤵
        
        PID:10756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25116.exe
        5⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62934.exe
        5⤵
        
        PID:15816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        5⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        6⤵
        
        PID:16560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16560 -s 436
        7⤵
        Program crash
        
        PID:10908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53400.exe
        5⤵
        
        PID:9464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2279.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
      4⤵
      PID:8832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18498.exe
      4⤵
      PID:15728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
      4⤵
      PID:6196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
    3⤵
    PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe
        5⤵
        
        PID:11052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37909.exe
        5⤵
        
        PID:14716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
      4⤵
      PID:11028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
      4⤵
      PID:16484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8129.exe
      4⤵
      PID:8892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28260.exe
    3⤵
    PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34153.exe
      4⤵
      PID:11232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33357.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50967.exe
      4⤵
      PID:9720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12778.exe
    3⤵
    PID:10364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57769.exe
    3⤵
    PID:18196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31768.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31768.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43906.exe
    3⤵
    PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
      4⤵
      PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37587.exe
        5⤵
        
        PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        5⤵
        
        PID:13848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46550.exe
      4⤵
      PID:10188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61699.exe
      4⤵
      PID:14040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30363.exe
      4⤵
      PID:13280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
    3⤵
    PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39419.exe
      4⤵
      PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64433.exe
        5⤵
        
        PID:11360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        5⤵
        
        PID:18436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31852.exe
      4⤵
      PID:13004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17432.exe
      4⤵
      PID:17496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24480.exe
    3⤵
    PID:8212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65008.exe
    3⤵
    PID:13968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47429.exe
    3⤵
    PID:13936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41237.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41237.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49765.exe
    3⤵
    PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58099.exe
      4⤵
      PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        5⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50790.exe
        5⤵
        
        PID:13272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        5⤵
        
        PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52824.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6430.exe
      4⤵
      PID:17732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56279.exe
    3⤵
    PID:9168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17127.exe
      4⤵
      PID:1232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30764.exe
    3⤵
    PID:12232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
    3⤵
    PID:18268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45449.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45449.exe
  2⤵
  PID:5548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
    3⤵
    PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63369.exe
      4⤵
      PID:8716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3727.exe
      4⤵
      PID:13092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
      4⤵
      PID:18292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9845.exe
    3⤵
    PID:9348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46598.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37488.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37488.exe
  2⤵
  PID:1904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
    3⤵
    PID:14012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
    3⤵
    PID:12956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46333.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46333.exe
  2⤵
  PID:7896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54311.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54311.exe
  2⤵
  PID:15372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1904 -ip 1904
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6652 -ip 6652
1⤵
PID:7248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 6288 -ip 6288
1⤵
PID:9004

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:14616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 10736 -ip 10736
1⤵
PID:19128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:18792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 16560 -ip 16560
1⤵
PID:10964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11342.exe

Filesize
468KB

MD5
c7dca9da125d9a42aba9f031ce886800

SHA1
8045ba044113c9c481568a297b75798c04090fcb

SHA256
e4c2d379e128440e35b9149cde24b1fd2bf7ec07a83f9be885caad9d33b9c60f

SHA512
05b10b718ce10fab031ff41f403c592886fd298b902c6273c394a16e0a65478e0c2578745536f72e4c793227d0fce94a9e56e71a0c39c0000ef9587a1ad594b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13075.exe

Filesize
468KB

MD5
a9eaf4b2e7104be370ca13e3f16fd1cd

SHA1
8d43692069bba902defa1c6321f68e53ad63279f

SHA256
1c9ee1f3d96403ab251175b0d3fbdbe75c86d8b073dcaeb282d3e6f7be44d699

SHA512
c3cd3b12bc50dc17883ba8277f4a0305ca24919cd5628193c7e906e8b647adadb63ac50035a47ecde6a8e8e40016d3110b8b7fbd5914610cd1299f67c4f752ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14558.exe

Filesize
468KB

MD5
ea2e10154f5aecf9a50741f1c3862784

SHA1
b62681b7de9ab927535bc17813ca05da36317caf

SHA256
32bab26cee22a269e092d9dcb90775d54fb9a8d54f8925a8173352dd7d9f9d67

SHA512
8ad15882e18b741c7c2f08c1f8da17a608afff1653bf165bd1e66bf493de15d0b28f2bda516ae7b8a488a1aea1228f1ff560cc0f65eb0144c0902a1f846dbe1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exe

Filesize
468KB

MD5
498ba0794e18425ab342f53f45cf1934

SHA1
f686e633b9e45f0dc367aedf83e59a7f81c263d3

SHA256
aa65f9b17d9aebb79143f9ad68f3b613f43ebf5925f23d68d4065911dbe0db7b

SHA512
1cf7601c9a31d2e79512e00ca848d0d8a552beeefa841d5dd6b99a0fabc25e6ca9d280d2460a1077301b881df98da75b7af9ddbb9582eb7c99dcc9ade50b9b35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe

Filesize
468KB

MD5
99f37b1c1e93895a8cd18e959d8b4a60

SHA1
2a6c1f621ef3e0994f50a4cdb801d27dc2790c07

SHA256
65c7b6875c5b51c8cc9a7d09f3506fc9e380680accf19c7dfc2c431c4b4304ac

SHA512
8df97c8ff8a26127577d9b2b3e53cba94ed003c65770251dd95afb0a16784df58e9f8531d4a8ce7ae2f9511aa371e2bcf76487aa1b3b75b7dd84f71007b7ec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1975.exe

Filesize
468KB

MD5
86d9a6c64f78ec2890410b90a8f4f068

SHA1
9c78dd3d8a5eb2017fc39508ffe3821ef39f1bdb

SHA256
1e176ac78c3ad27e7b5d4e864c5ad62f722cc270b702bd0eca0e79e8d1f6cf1e

SHA512
c73387da5fa92cd8403f991acb58de354664d177f07b45480fca9457ab130028d07cb0fbed43659a70cbb985bd1bfdc6ab2ea5ff9d8ecdbd2d465bf64fa18263

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe

Filesize
468KB

MD5
89b424f18c200f8297097bc8f32e90f2

SHA1
f723df00da18b597c0aae3d9dbb7607df527e2f4

SHA256
256ae0937cf0f75246ff3cf30f7bef8e168d9bd4272195093bf35e876103ea2e

SHA512
5e0ea29cd3a6167552ed3e2d039894f4c0af40b0e41226965768568866753e7140571d730992f92a1024c3962c6556ebacc039d421f987ab024d58296664d130

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20833.exe

Filesize
468KB

MD5
65878314c9e9b8ff99c832a0412c0b57

SHA1
ba6504bdf0beea5c76d755d6920651a1a1269931

SHA256
4d753814324a6c4cd0bf6a8d45d8ac240613995cf2707735ee7860e4cf569b11

SHA512
d983fb685e7a6c3abeb2a9d4b881d7a4ce484dc47db9f21ec03cdd09b9483edf0f5869849409f4b0576f2d3f7a55c76a2470b70c51f0cb2f5cf0a41a86ddee93

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23330.exe

Filesize
468KB

MD5
51ed7dc37016dd8a8cc4c0329fdd7d94

SHA1
6c52663779dac83706fa2aff4dec0c9575006bc9

SHA256
836de408445556abfa038835d14acabc31511f17a761a77fde8f9444f965b073

SHA512
df28d872e1c47a2a735bcfbce28a56fb9d6f630ee7ffd28e8285da399d91264b3104f6a40392f81b452468b08ad0d89500b2d6686c088416389e70e87f43133f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe

Filesize
468KB

MD5
78e4dd2c618b84d8e6a2e38238fcfc4e

SHA1
8255617681493660aaa62e37bd40143d6cf07447

SHA256
5d61019c2e49fa49df7d10da47dc3fa56bb8aa562e3136bba62d7fe2ad42d945

SHA512
ae8613c6a4eb284dcbc506e1916d15d10ef11462ed1419edf1369096cf1acb29a53742e0bbbb9676c7947bef913fca3e31defdb2b9e0ed7157c06306bb093a71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe

Filesize
468KB

MD5
c5960ac11c85d328e4bfad9329cc85a2

SHA1
030df399f7736c7819bbfb37220ef0c0fdb1bf3d

SHA256
d1330084766bf2848e49840c67b384494f82c32605313f95f827d1030b4b32ef

SHA512
5a1e88295a9fadd8ab2ec4ea78b5d9bcff93b67f9d0b069252f1723703e53f4c3ac058f317cca37a4eedbe0eabe2c1b51d507fa062b92e83e60a4bff356c66f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31768.exe

Filesize
468KB

MD5
6bd6d60bcc3b49e74ac32faf09593ba4

SHA1
799388ec973660ddf0fd460a7b02b66d2e1f092d

SHA256
d04506590cf3480db0d49850f70673c974c4d0058358717d0c1625e043c1a06b

SHA512
97097e7f5ca6a1f258dd7113fd266621dc6a21a75158cf0138dec37cdc57d5bb4dadf517c899a76ce415a290a761519cd67791851beb3a2367d442743ffc18e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe

Filesize
468KB

MD5
165ce34974edf515bb0616f650473dca

SHA1
c71f5bc6c66273adfe9590554f033bcf13420370

SHA256
028eb67f0e3a96547054b66f18346cdac49a2ab3bf1694f1773d0e4cd6c9b53b

SHA512
5f3e605f6437e3fb06110ad43fb4f9cdbe027edf2a73024b93a28d8cf3adb0ed12875772bdd5e582b6db0ab7a48beb80bfec73e139500fbb41c2fc7278abe677

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32676.exe

Filesize
468KB

MD5
7fa11d5884789f2e687a96e2fb53af41

SHA1
c7301860c1884b4e73d13ac76057730af687fa07

SHA256
475fe984dbe125eee30ee981b7dde703d8f9436e12e050a7b3a6bf876b235de9

SHA512
470bae7ce71e9df8bb336571567f7600ac45af00f6cce1c88e4fea2d0613f3c3e17366af00ba0eedef85df70b32aa6c0cf1c856d4b80e24f0b7e3e29f6e334c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe

Filesize
468KB

MD5
5434cbdb86591b0a9fbabfdab7d6ebef

SHA1
a5dbe3cc0cf9628c6c07edbfd555cefc6e0baf00

SHA256
37755d7119dcc849615391f3bb17e55e9239d1798a54cca731885801c3c999ed

SHA512
d192c8f3aa1b4f0c0d7510f1b0d467fa67cb3494e6783eb220823cf444eab868861fab7fee5e27d7d9f256e4aff46549d8ca1f7cc613f338068ae621ede7ddfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exe

Filesize
468KB

MD5
bfa8f178e0759aaf15534ff9917f5f25

SHA1
aa7af7b310ad1b9509743bb8a497b8e9c5ce092d

SHA256
7bab1f1216d6bc3ed52cf1b35ae0a5676a248695d23f24a6f550919a755668fe

SHA512
0107559a5b8600c4d267f12ecf2f769428f5980494d3323aeeaaaa4f96afd50223966efaf7df733e1eebc5f6419c13767a741b9da191dd54f274bce293a34496

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe

Filesize
468KB

MD5
a708e12b9a0d9fa50fe5a4f52e79d6ab

SHA1
816ce2f70c13d1ac4d2d53b821acb42aef85fa79

SHA256
6cbe77b3377562c652a631ff16f6c7132bd6109a9d731cea4697566e7f5b2b05

SHA512
35b1cbdd77d767b82497c80fbc76fcb31305609565abdf344d28e9696f7c363851b7ff38d46ecfce4fc114e37e882199ead5727427feb7b298c1ba0e9a9e78a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39329.exe

Filesize
468KB

MD5
46a5dad304b30560e230ccef4609845b

SHA1
43cf7e12bb5acbe6146649679bca84aaa10f1184

SHA256
825487d48114cb8e817a865024f5782dfa50cefce178c94116f11470bb754ca2

SHA512
503f6b6523b46584da58cebbfe3e16794889634da95d6e2df660e38af6f7153e694a986c72361e17d088f0b9c93a2080b814c5ed27109eb223f54b105c51dfb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40699.exe

Filesize
468KB

MD5
0af9bcae230be5be0103f90b468647e6

SHA1
bbf943e8932717e341bfa9a629b0d093f41c2775

SHA256
6817b7a5a91f2629d7721d3a912652ac30ae64c908ab5155634c679637b18032

SHA512
6758f77d624f3e6c9d1642fd2c45712ba6e86d35b998d199b21db5c406c13043e6c114d6385ea70e0f8caf8be90df9cd6776a578ff5339735fc054b117a9e4b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4352.exe

Filesize
468KB

MD5
be90e391e57db3af5413aacc7bd46ed2

SHA1
e07e92068788b7d8246557ab1a0810c78085d109

SHA256
aa75bb4310a989d19d4662474e01a6018f93083728defcb72d8263d30f14852f

SHA512
050f4f73c76c5ca000d7d4dae11eb19e8ee2270107793d2808303a6aaa932c8047c0ae2db1e79fad9e1e83358a3626739d2c26554fbdf7cd25e01fce73d435af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45451.exe

Filesize
468KB

MD5
c683ab9f0bbf5d97bb0912b7b23ec221

SHA1
e8d1a1d3dfcd10ca73b04279111126ad48e9d8db

SHA256
44307d4035137f53303b51c5627b02f9aecc98af86fa079436d729f3ef7d498c

SHA512
85ecf8f9d966e557cf3f5e23b9e5288548ff968ebba3dcab5960dca86c331e9b5b04ad83da08d93a5c4029dc4310739bf8ba227bdee5a05995e13f53b7f222ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49687.exe

Filesize
468KB

MD5
5e2673e382e246f7e4aba9bb35028c1b

SHA1
3675b085a3c0f19303072b77246ea84cd22b23d5

SHA256
dd92794fb7653d4664f9c03fdf2b4166e8f466fc67b1f7690f773f13de8c7e41

SHA512
edf589528f4099ecd9dd477f4ca5956321046985d4983a822ce7e71a93f57fb2dea7859f91680a9e2265b3b1d6244fec7426ce070c8fa52c2ae2b1b4ced2c39c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50024.exe

Filesize
468KB

MD5
628930efa0b7d69e4d98d6a175a005b6

SHA1
1e0ebe3200148338834935b36d163c3598242bb2

SHA256
b62eaed43425c9f25a34e6b7d2b2c217df902e0977e05d8c0431993bb2e9c496

SHA512
2884eebac078ed2730b82493accaa17e8073a5236980b8e8959203de3dd79576b0accfa9cea640fe2fb5691510f201704be63cd7648bac606cb750c0ffba0372

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe

Filesize
468KB

MD5
bbca6a15d9726f26b839652a196e9ce9

SHA1
ec96a552149b29dd72c14f80ee3cfe122ca10042

SHA256
0ea33f5dc92d15284e8c7709e0707ecb2d6772bccc68ca0f1616c0fc48a38150

SHA512
8fc5688030c8457782005917edc5000489728a691186227c3ff00eb343cf2ce45a8c7d79554229b3e1324d26cd067be47df98c3f974199f289979b19cdbddf71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53641.exe

Filesize
468KB

MD5
00b18140f3521bdab49fb9f33710de09

SHA1
fb58008f78094d8e70d2186fcebec6ec05ed9ae9

SHA256
6665e755816ee30a1bbb6cf00415e8ae92117a0ea3bb72073ecb3d5e8c5e53db

SHA512
3d17df61785536d77cf7a5f48b9df76d935e8c88ad0228c4f0ccb7fbaa46cd45dcb48d3632fcc7f2e47bb026dfc97e867bcab2ee40851878f787f325ad274026

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55499.exe

Filesize
468KB

MD5
67911639712afef9bca7188e70844023

SHA1
43ea142da956812032dde92d39e7eda1017a0d76

SHA256
838abb2a86df6e4ec2227ba9d9ba4cfa6980caa2a6452c04d0f95caada1eb5dc

SHA512
519148b0521af0aed5179970be4b105e110e5e9632ecadf23c12d00211f47f355d7f4359620e7778224ea8be4d508df32655bc525064b640919b2e684822d933

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55809.exe

Filesize
468KB

MD5
a3378419166cf2ad3dba2954a384c184

SHA1
fe25c52f168d61f13942761a4cfffa9500ce2cd1

SHA256
6b25b2e942b61d6077209806730b7d238269cb7afae269b7315e3a6d19744224

SHA512
82dec72322badd3e9f5a900b9c5582742702ce10f4b82229318a547c4d2e402ace666da227456f9fd8b5fe754eae48792318c9bc447df7c619553d674fc66191

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe

Filesize
468KB

MD5
f1b103334b84f6e0231f1bf9c6b74698

SHA1
0cdd904bfeb95b5ef4f9f8024cba22329256d530

SHA256
fbd13f1c10a37edb5568cec068c4236cee45e9944cef03aa96649a856f6a9443

SHA512
21570850f4fe91746b9f440acc5d3e1b026df8d31ff207a60acd03d635f222bf532a4c99f801da5c600fb77b63e824f80780b8160cdb7b6d9c4f3d77171701b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61939.exe

Filesize
468KB

MD5
e2c8c4befa2801fc5815ae7cff895a70

SHA1
defbd938fad0be71b5e81e083c34893ab6faf8ae

SHA256
c77da93c6d7f1c5e526ca29a28ae41725c5af932d8686e0bedb41fb8873ad3ce

SHA512
6afdcb0e6a31f544bcfc3cfda4615570b74b5070e43a6c8dde315ac678d29bb3bb5040ffb74eff767399364e082fb3a299936e2144dc0d8fa2e9af4e5ca0c533

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65182.exe

Filesize
468KB

MD5
0e3c3c0f3327a2f6ed1c19f80b531947

SHA1
a1aa8b5de07acf05d25bb9fc2ff4f9c3e2f15a31

SHA256
bdbcbd2f4e1daae9efb2a0be302f96aea1e52df5a546585d20f45c7922cc32a5

SHA512
15fb6c8994555cbeeaab96bca54e14023b5d5d108aa90fb45a21082dd8b5aba8b7cb1f22176e89d1d1d07db3bc344822a21cd4f3ddc71bbc5b20fdad86ed6db9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe

Filesize
468KB

MD5
cb05fa95ab28b7e4ac5312315fb46098

SHA1
751a7c9587ec8f7097a6a61ea457718225233401

SHA256
5de6e4dd5cccd89916207896cb7dfac85f07bd022982afc4789105529d6f6023

SHA512
41b2e89ac9ecabe23dff99df288bf25e1c4081d6f6d4e1036214b8a94f1b430615d1bbca8ac68aa93dc7e20086f3d9fa797abf79cf6256756e9fbf686af993bd

Download Submit
memory/60-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/212-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/324-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/412-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/436-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/744-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/760-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/932-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/968-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1016-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1040-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1116-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1124-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1140-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1188-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1340-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1420-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1748-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1764-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1808-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1824-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1864-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1868-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1892-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1904-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2004-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2112-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2136-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2204-32-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2220-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2252-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2396-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2660-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2716-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2724-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2740-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3076-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3120-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3124-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3168-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3220-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3240-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3372-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3388-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3404-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3456-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3516-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3636-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3784-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3800-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3808-100-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3908-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3944-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4008-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4112-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4372-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4400-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4420-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4456-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4464-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4548-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4656-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4688-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4696-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4708-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4800-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4828-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4836-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4880-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4920-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4996-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5012-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5100-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5116-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5176-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5200-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5244-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5316-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5344-533-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5380-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5388-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5404-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5428-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5448-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5460-560-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5468-545-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5548-565-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5560-568-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6396-3398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6904-3394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7324-2416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7504-3425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7644-3527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/8588-3319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/8968-3429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/9604-3543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/9720-3505-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14648-2453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15864-3537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads