a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98d

Analysis

max time kernel
112s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 20:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe
Size 468KB
Sample240929-zh7cestdla
SHA256 a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98d
MD5 8cfb3af88d14a326f7688499ac334650
SHA1 22f3f2b1c7fd005b78f6fb3f6b3bfb8986dbcecb
SHA512 a58a87af65bff7598de5c780213d208fa7a40db12d9beb9ac76693bb4eba5a6f5c4dbe162ec9857a4c56162563c759b8253f6cc289a7ea475c602f06d1fbd38b
SSDEEP 3072:lQAoogIIId5KtbY3Pztjcf8/GCtvg3pnrjHeLVhOKe78/+BP5HlC:lQboBbKtQPJjcfLZuCKeoWBP5
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2960	Unicorn-57508.exe
2112	Unicorn-51369.exe
2716	Unicorn-777.exe
2968	Unicorn-50383.exe
2740	Unicorn-48437.exe
2284	Unicorn-30517.exe
2616	Unicorn-21694.exe
3052	Unicorn-46958.exe
1816	Unicorn-53180.exe
1716	Unicorn-47050.exe
1684	Unicorn-37398.exe
1884	Unicorn-26538.exe
1620	Unicorn-30165.exe
268	Unicorn-30430.exe
1540	Unicorn-10564.exe
620	Unicorn-41011.exe
2920	Unicorn-21529.exe
2320	Unicorn-4446.exe
904	Unicorn-20682.exe
1364	Unicorn-26813.exe
2476	Unicorn-6947.exe
2272	Unicorn-17882.exe
1156	Unicorn-11031.exe
2796	Unicorn-59988.exe
1748	Unicorn-40387.exe
2428	Unicorn-54123.exe
2088	Unicorn-60253.exe
2468	Unicorn-56325.exe
2736	Unicorn-46766.exe
1048	Unicorn-35220.exe
2864	Unicorn-52717.exe
2604	Unicorn-43943.exe
2644	Unicorn-43388.exe
2648	Unicorn-23522.exe
996	Unicorn-56963.exe
1116	Unicorn-56963.exe
1700	Unicorn-13792.exe
1720	Unicorn-33658.exe
2160	Unicorn-52032.exe
1768	Unicorn-32696.exe
1276	Unicorn-2739.exe
2784	Unicorn-16864.exe
2564	Unicorn-17130.exe
1796	Unicorn-17130.exe
2932	Unicorn-30049.exe
2292	Unicorn-35915.exe
2104	Unicorn-50570.exe
2012	Unicorn-54654.exe
920	Unicorn-4062.exe
1632	Unicorn-31995.exe
1784	Unicorn-38126.exe
2504	Unicorn-8775.exe
992	Unicorn-17706.exe
2344	Unicorn-42764.exe
3048	Unicorn-23736.exe
2524	Unicorn-59101.exe
2868	Unicorn-48240.exe
2680	Unicorn-30433.exe
2528	Unicorn-20036.exe
1484	Unicorn-63569.exe
1984	Unicorn-26066.exe
632	Unicorn-53839.exe
1528	Unicorn-38986.exe
1804	Unicorn-32672.exe

Loads dropped DLL 64 IoCs

pid	Process
2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe
2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe
2960	Unicorn-57508.exe
2960	Unicorn-57508.exe
2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe
2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe
2716	Unicorn-777.exe
2112	Unicorn-51369.exe
2960	Unicorn-57508.exe
2112	Unicorn-51369.exe
2960	Unicorn-57508.exe
2716	Unicorn-777.exe
2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe
2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe
2284	Unicorn-30517.exe
2284	Unicorn-30517.exe
2968	Unicorn-50383.exe
2968	Unicorn-50383.exe
2960	Unicorn-57508.exe
2960	Unicorn-57508.exe
2716	Unicorn-777.exe
2716	Unicorn-777.exe
2740	Unicorn-48437.exe
2740	Unicorn-48437.exe
2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe
2112	Unicorn-51369.exe
2616	Unicorn-21694.exe
2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe
2112	Unicorn-51369.exe
2616	Unicorn-21694.exe
3052	Unicorn-46958.exe
3052	Unicorn-46958.exe
2284	Unicorn-30517.exe
2284	Unicorn-30517.exe
1620	Unicorn-30165.exe
1620	Unicorn-30165.exe
2112	Unicorn-51369.exe
2112	Unicorn-51369.exe
1884	Unicorn-26538.exe
1884	Unicorn-26538.exe
2616	Unicorn-21694.exe
2740	Unicorn-48437.exe
2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe
2616	Unicorn-21694.exe
2740	Unicorn-48437.exe
2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe
2960	Unicorn-57508.exe
2960	Unicorn-57508.exe
2968	Unicorn-50383.exe
2716	Unicorn-777.exe
1816	Unicorn-53180.exe
2968	Unicorn-50383.exe
2716	Unicorn-777.exe
1816	Unicorn-53180.exe
620	Unicorn-41011.exe
620	Unicorn-41011.exe
3052	Unicorn-46958.exe
3052	Unicorn-46958.exe
2920	Unicorn-21529.exe
2920	Unicorn-21529.exe
2284	Unicorn-30517.exe
2284	Unicorn-30517.exe
268	Unicorn-30430.exe
268	Unicorn-30430.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2024	1484	WerFault.exe	90
3524	2884	WerFault.exe	138

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61924.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe
2960	Unicorn-57508.exe
2112	Unicorn-51369.exe
2716	Unicorn-777.exe
2968	Unicorn-50383.exe
2284	Unicorn-30517.exe
2740	Unicorn-48437.exe
2616	Unicorn-21694.exe
3052	Unicorn-46958.exe
1816	Unicorn-53180.exe
1684	Unicorn-37398.exe
1716	Unicorn-47050.exe
1884	Unicorn-26538.exe
268	Unicorn-30430.exe
1620	Unicorn-30165.exe
1540	Unicorn-10564.exe
620	Unicorn-41011.exe
2920	Unicorn-21529.exe
2320	Unicorn-4446.exe
2272	Unicorn-17882.exe
2476	Unicorn-6947.exe
904	Unicorn-20682.exe
1364	Unicorn-26813.exe
1748	Unicorn-40387.exe
2088	Unicorn-60253.exe
2796	Unicorn-59988.exe
1156	Unicorn-11031.exe
2428	Unicorn-54123.exe
2468	Unicorn-56325.exe
2736	Unicorn-46766.exe
1048	Unicorn-35220.exe
2864	Unicorn-52717.exe
2604	Unicorn-43943.exe
2644	Unicorn-43388.exe
2648	Unicorn-23522.exe
996	Unicorn-56963.exe
1116	Unicorn-56963.exe
1700	Unicorn-13792.exe
1720	Unicorn-33658.exe
1768	Unicorn-32696.exe
1276	Unicorn-2739.exe
1796	Unicorn-17130.exe
2160	Unicorn-52032.exe
2564	Unicorn-17130.exe
2784	Unicorn-16864.exe
2292	Unicorn-35915.exe
2104	Unicorn-50570.exe
2932	Unicorn-30049.exe
920	Unicorn-4062.exe
2012	Unicorn-54654.exe
1784	Unicorn-38126.exe
1632	Unicorn-31995.exe
992	Unicorn-17706.exe
2504	Unicorn-8775.exe
2344	Unicorn-42764.exe
3048	Unicorn-23736.exe
2524	Unicorn-59101.exe
2868	Unicorn-48240.exe
2680	Unicorn-30433.exe
2528	Unicorn-20036.exe
1484	Unicorn-63569.exe
1984	Unicorn-26066.exe
632	Unicorn-53839.exe
1528	Unicorn-38986.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2960	2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe	31
PID 2376 wrote to memory of 2960	2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe	31
PID 2376 wrote to memory of 2960	2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe	31
PID 2376 wrote to memory of 2960	2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe	31
PID 2960 wrote to memory of 2112	2960	Unicorn-57508.exe	32
PID 2960 wrote to memory of 2112	2960	Unicorn-57508.exe	32
PID 2960 wrote to memory of 2112	2960	Unicorn-57508.exe	32
PID 2960 wrote to memory of 2112	2960	Unicorn-57508.exe	32
PID 2376 wrote to memory of 2716	2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe	33
PID 2376 wrote to memory of 2716	2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe	33
PID 2376 wrote to memory of 2716	2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe	33
PID 2376 wrote to memory of 2716	2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe	33
PID 2112 wrote to memory of 2740	2112	Unicorn-51369.exe	35
PID 2112 wrote to memory of 2740	2112	Unicorn-51369.exe	35
PID 2112 wrote to memory of 2740	2112	Unicorn-51369.exe	35
PID 2112 wrote to memory of 2740	2112	Unicorn-51369.exe	35
PID 2960 wrote to memory of 2284	2960	Unicorn-57508.exe	36
PID 2960 wrote to memory of 2284	2960	Unicorn-57508.exe	36
PID 2960 wrote to memory of 2284	2960	Unicorn-57508.exe	36
PID 2960 wrote to memory of 2284	2960	Unicorn-57508.exe	36
PID 2716 wrote to memory of 2968	2716	Unicorn-777.exe	34
PID 2716 wrote to memory of 2968	2716	Unicorn-777.exe	34
PID 2716 wrote to memory of 2968	2716	Unicorn-777.exe	34
PID 2716 wrote to memory of 2968	2716	Unicorn-777.exe	34
PID 2376 wrote to memory of 2616	2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe	37
PID 2376 wrote to memory of 2616	2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe	37
PID 2376 wrote to memory of 2616	2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe	37
PID 2376 wrote to memory of 2616	2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe	37
PID 2284 wrote to memory of 3052	2284	Unicorn-30517.exe	38
PID 2284 wrote to memory of 3052	2284	Unicorn-30517.exe	38
PID 2284 wrote to memory of 3052	2284	Unicorn-30517.exe	38
PID 2284 wrote to memory of 3052	2284	Unicorn-30517.exe	38
PID 2968 wrote to memory of 1816	2968	Unicorn-50383.exe	39
PID 2968 wrote to memory of 1816	2968	Unicorn-50383.exe	39
PID 2968 wrote to memory of 1816	2968	Unicorn-50383.exe	39
PID 2968 wrote to memory of 1816	2968	Unicorn-50383.exe	39
PID 2960 wrote to memory of 1716	2960	Unicorn-57508.exe	40
PID 2960 wrote to memory of 1716	2960	Unicorn-57508.exe	40
PID 2960 wrote to memory of 1716	2960	Unicorn-57508.exe	40
PID 2960 wrote to memory of 1716	2960	Unicorn-57508.exe	40
PID 2716 wrote to memory of 1684	2716	Unicorn-777.exe	41
PID 2716 wrote to memory of 1684	2716	Unicorn-777.exe	41
PID 2716 wrote to memory of 1684	2716	Unicorn-777.exe	41
PID 2716 wrote to memory of 1684	2716	Unicorn-777.exe	41
PID 2740 wrote to memory of 1884	2740	Unicorn-48437.exe	42
PID 2740 wrote to memory of 1884	2740	Unicorn-48437.exe	42
PID 2740 wrote to memory of 1884	2740	Unicorn-48437.exe	42
PID 2740 wrote to memory of 1884	2740	Unicorn-48437.exe	42
PID 2376 wrote to memory of 1620	2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe	43
PID 2376 wrote to memory of 1620	2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe	43
PID 2376 wrote to memory of 1620	2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe	43
PID 2376 wrote to memory of 1620	2376	a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe	43
PID 2112 wrote to memory of 1540	2112	Unicorn-51369.exe	44
PID 2112 wrote to memory of 1540	2112	Unicorn-51369.exe	44
PID 2112 wrote to memory of 1540	2112	Unicorn-51369.exe	44
PID 2112 wrote to memory of 1540	2112	Unicorn-51369.exe	44
PID 2616 wrote to memory of 268	2616	Unicorn-21694.exe	45
PID 2616 wrote to memory of 268	2616	Unicorn-21694.exe	45
PID 2616 wrote to memory of 268	2616	Unicorn-21694.exe	45
PID 2616 wrote to memory of 268	2616	Unicorn-21694.exe	45
PID 3052 wrote to memory of 620	3052	Unicorn-46958.exe	46
PID 3052 wrote to memory of 620	3052	Unicorn-46958.exe	46
PID 3052 wrote to memory of 620	3052	Unicorn-46958.exe	46
PID 3052 wrote to memory of 620	3052	Unicorn-46958.exe	46

C:\Users\Admin\AppData\Local\Temp\a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe
"C:\Users\Admin\AppData\Local\Temp\a292b42dee92427350ef5b60b871448880821765718153919e522ee6b11aa98dN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57508.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57508.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51369.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48437.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26813.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57835.exe
        8⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39595.exe
        9⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        9⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        8⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
        8⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23701.exe
        8⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28239.exe
        7⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52810.exe
        8⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        7⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
        7⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        7⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40767.exe
        7⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42764.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56875.exe
        7⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48531.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        8⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        7⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        7⤵
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52839.exe
        7⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
        7⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6396.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37073.exe
        7⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        7⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
        6⤵
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe
        6⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23283.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34179.exe
        6⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54654.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65292.exe
        7⤵
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42282.exe
        8⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51535.exe
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        7⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41617.exe
        7⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8670.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17631.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        6⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23701.exe
        6⤵
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
        6⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
        7⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        6⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29564.exe
        6⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17113.exe
        5⤵
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41051.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        5⤵
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48368.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53369.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37497.exe
        5⤵
        
        PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10564.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23522.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36071.exe
        6⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        7⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe
        6⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29294.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10891.exe
        6⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32654.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23970.exe
        6⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49164.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4.exe
        5⤵
        
        PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25741.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12648.exe
        5⤵
        
        PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20682.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2739.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exe
        6⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32552.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41091.exe
        7⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8394.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45365.exe
        6⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30856.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
        6⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31363.exe
        5⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25205.exe
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        6⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        5⤵
        
        PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40767.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16864.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        5⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39595.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        6⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        5⤵
        
        PID:892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        5⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6922.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        6⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
        5⤵
        
        PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
      4⤵
      PID:700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36723.exe
      4⤵
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65434.exe
      4⤵
      PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe
      4⤵
      PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7313.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30517.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46958.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41011.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56325.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23736.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51333.exe
        8⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30943.exe
        8⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1586.exe
        8⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1281.exe
        8⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        7⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        7⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48102.exe
        7⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19236.exe
        7⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        7⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39595.exe
        8⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        8⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        7⤵
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        7⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5109.exe
        6⤵
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61924.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48102.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19236.exe
        6⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46766.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48240.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47337.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8676.exe
        8⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16491.exe
        8⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        7⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4607.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        7⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23701.exe
        7⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37585.exe
        6⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        7⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19922.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        6⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58683.exe
        6⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30433.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        6⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39595.exe
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        7⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27030.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33552.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56237.exe
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40237.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        5⤵
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27486.exe
        6⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        5⤵
        
        PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48102.exe
        5⤵
        
        PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19236.exe
        5⤵
        
        PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21529.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35220.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48095.exe
        7⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32884.exe
        7⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36449.exe
        7⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35250.exe
        6⤵
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
        6⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52568.exe
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
        6⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63569.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9594.exe
        6⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23871.exe
        7⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 236
        7⤵
        Program crash
        
        PID:3524
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 216
        6⤵
        Program crash
        
        PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5109.exe
        5⤵
        
        PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5594.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37417.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12648.exe
        5⤵
        
        PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52717.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14773.exe
        5⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe
        6⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
        6⤵
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56237.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40237.exe
        6⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        5⤵
        
        PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        5⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2342.exe
        5⤵
        
        PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56226.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39500.exe
        5⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39522.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19905.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56876.exe
      4⤵
      PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
      4⤵
      PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36265.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8564.exe
      4⤵
      PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47050.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56963.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32672.exe
        5⤵
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5173.exe
        6⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14275.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32364.exe
        6⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35250.exe
        5⤵
        
        PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44400.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe
        5⤵
        
        PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18373.exe
      4⤵
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20462.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20575.exe
        5⤵
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62009.exe
      4⤵
      PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26571.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13901.exe
      4⤵
      PID:304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59988.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59988.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38126.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        5⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24629.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        6⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8394.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20668.exe
        5⤵
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41163.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17113.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37668.exe
      4⤵
      PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe
        5⤵
        
        PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
      4⤵
      PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
      4⤵
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52839.exe
      4⤵
      PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
      4⤵
      PID:5924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8775.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20311.exe
      4⤵
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53793.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47218.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe
      4⤵
      PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29294.exe
      4⤵
      PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13029.exe
      4⤵
      PID:5716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe
    3⤵
    PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49906.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28281.exe
      4⤵
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6961.exe
      4⤵
      PID:5888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57406.exe
    3⤵
    PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe
      4⤵
      PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
      4⤵
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63807.exe
      4⤵
      PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42314.exe
      4⤵
      PID:5420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38568.exe
    3⤵
    PID:3764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12421.exe
    3⤵
    PID:4556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45230.exe
    3⤵
    PID:5600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-777.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-777.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50383.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53180.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60253.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8525.exe
        7⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39595.exe
        8⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53440.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        7⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        7⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43013.exe
        6⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1847.exe
        7⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        6⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
        6⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        6⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4062.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24203.exe
        6⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        6⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
        6⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38493.exe
        5⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62345.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65087.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7313.exe
        5⤵
        
        PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40387.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45583.exe
        6⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39595.exe
        7⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        7⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        6⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27426.exe
        6⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15411.exe
        5⤵
        
        PID:896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9639.exe
        6⤵
        
        PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        5⤵
        
        PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40767.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        5⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29533.exe
        6⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        5⤵
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
        5⤵
        
        PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
      4⤵
      PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
      4⤵
      PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe
      4⤵
      PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41697.exe
      4⤵
      PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37398.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37398.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56963.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32672.exe
        5⤵
        Executes dropped EXE
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32942.exe
        6⤵
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30943.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38535.exe
        6⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38230.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        5⤵
        
        PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        5⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40767.exe
        5⤵
        
        PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24403.exe
      4⤵
      PID:1132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30851.exe
        5⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        5⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20452.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe
      4⤵
      PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52615.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        5⤵
        
        PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
      4⤵
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52911.exe
      4⤵
      PID:5216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54123.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe
        5⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41074.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28041.exe
        6⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14259.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40784.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55354.exe
        5⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42832.exe
        5⤵
        
        PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57622.exe
      4⤵
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2838.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59676.exe
      4⤵
      PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50544.exe
      4⤵
      PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
      4⤵
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13029.exe
      4⤵
      PID:5732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35915.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58110.exe
      4⤵
      PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52485.exe
      4⤵
      PID:560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
      4⤵
      PID:5520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19605.exe
    3⤵
    PID:1524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
    3⤵
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62009.exe
    3⤵
    PID:3584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3229.exe
    3⤵
    PID:5328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30430.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43943.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26066.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46896.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50544.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50372.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48902.exe
        6⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52839.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13029.exe
        5⤵
        
        PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38986.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33584.exe
        5⤵
        
        PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19922.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34179.exe
        5⤵
        
        PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47456.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64112.exe
        5⤵
        
        PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
      4⤵
      PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48368.exe
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61537.exe
      4⤵
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6426.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6947.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53839.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
        5⤵
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45817.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16491.exe
        6⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        5⤵
        
        PID:580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe
        5⤵
        
        PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25254.exe
      4⤵
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21204.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        5⤵
        
        PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27114.exe
      4⤵
      PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64904.exe
      4⤵
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44471.exe
      4⤵
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27957.exe
      4⤵
      PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52032.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
      4⤵
      PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
      4⤵
      PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20663.exe
      4⤵
      PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19905.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
    3⤵
    PID:272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48368.exe
    3⤵
    PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53369.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12648.exe
    3⤵
    PID:5396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30165.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30165.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4446.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4446.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8805.exe
        5⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21248.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
        5⤵
        
        PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        5⤵
        
        PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
      4⤵
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55931.exe
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        5⤵
        
        PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59676.exe
      4⤵
      PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50544.exe
      4⤵
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47987.exe
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17113.exe
      4⤵
      PID:5412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38702.exe
      4⤵
      PID:612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40498.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26797.exe
        5⤵
        
        PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe
      4⤵
      PID:776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
      4⤵
      PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40767.exe
      4⤵
      PID:5772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52691.exe
    3⤵
    PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42807.exe
      4⤵
      PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
      4⤵
      PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36449.exe
      4⤵
      PID:5472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4.exe
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe
    3⤵
    PID:3348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19199.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19199.exe
    3⤵
    PID:3728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42832.exe
    3⤵
    PID:5960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33658.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18858.exe
      4⤵
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
        5⤵
        
        PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16491.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14259.exe
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51474.exe
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59246.exe
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58576.exe
      4⤵
      PID:5856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
    3⤵
    PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54805.exe
      4⤵
      PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49932.exe
      4⤵
      PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59676.exe
    3⤵
    PID:1172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50544.exe
    3⤵
    PID:3356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
    3⤵
    PID:3608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13029.exe
    3⤵
    PID:5740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32696.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32696.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45282.exe
    3⤵
    PID:664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
    3⤵
    PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
    3⤵
    PID:3380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27426.exe
    3⤵
    PID:5136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2839.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2839.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe
    3⤵
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
    3⤵
    PID:5908
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32258.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32258.exe
  2⤵
  PID:3096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38568.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38568.exe
  2⤵
  PID:3872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30703.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30703.exe
  2⤵
  PID:4644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
  2⤵
  PID:5480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-10564.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10564.exe
Size 468KB
SHA256 91b4bf268c6473b4afdf7d87cc79459833e1945106605c8eaf44f6e95f3f8a61
MD5 812cdd66e2f86ca88cfc53282d35d0eb
SHA1 c720de281406b74c4b7b7927dec7d101a2caf2ce
SHA512 b537c4c986927fef5a7d4c81d0a5615071ec6e5ac267c4eb33f11a2a722287fce316c457bd74741b55856db7d9090fe8e3970b5c55639d6598bac0edab2ba468
SSDEEP 3072:lQAoogIIId5KtbY3Pztjcf8/GCtvg3pnrjHeLVhOKe48/+WPXHlC:lQboBbKtQPJjcfLZuCKeJWWPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-21694.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
Size 468KB
SHA256 3a9ef38f238513a66592eaa92d570627fdb99da4e554eadc7218e9ec2ad1a30b
MD5 9ee91124a798b046e686dd83f857f4e8
SHA1 567b77c38693ced020a701d72fae10615fe6218b
SHA512 67988a5c8d24b14e3dc4ab650127ed8d0ae1540f3da47bd279a0ebd154d0f55764ab39b871cf715e74db679d89821e31a0d2379a2b31540e2ffa2f8cc325cfed
SSDEEP 3072:lQAoogIIId5KtbY3Mztjcf8/GCtvg3pnrjHeLVhOKe78/+BP5HlC:lQboBbKtQMJjcfLZuCKeoWBP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-2839.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2839.exe
Size 468KB
SHA256 7b82eec9e2f2b53e0f7863f833a69037df0e8562e5b4d2c3033226560dc0468d
MD5 5bd26f2dd13dcb1c4bbed63450298dce
SHA1 54755b13670765a13469682ed2e56fc906e9adc9
SHA512 dc47c45b611ea315f60b31edbea51d4a50219e33fb98fe592dc4782e9482fe549c83762f6732c16d97e64833863ab691f980cf1210db71e2e2c580c7c2509dba
SSDEEP 3072:kQAoogIIId5KtbY3Pztjcf8/GCtvg3pnrjHeLVhOKe78/+BP5HlC:kQboBbKtQPJjcfLZuCKeoWBP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-30165.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-30165.exe
Size 468KB
SHA256 34ca2fedde97669d5892b130e0ad2142eb4419fddf20d222e887a3439a68aee9
MD5 843dc0522bc25dea6d29603c9d5360f3
SHA1 32b3c6409d46f5cc31ceae74bfc6240dac2e0348
SHA512 0acc715b1c69a5f41e4a36bbdea337935fc8b2e5da39680e6affd9068f7efb3d571c8654b8c0d9aa665c0fd84830236579ccab6cf6d9c3506c3e70092517b554
SSDEEP 3072:lQAoogIIId5KtbY3Pztjcf8/GCtvg3pnrjHeLVhOKe78/rBP5HlC:lQboBbKtQPJjcfLZuCKeoDBP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-37398.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37398.exe
Size 468KB
SHA256 34e2bfeadf38e627de0308a7ccf6a80de22fca87f439f4e8d6389337d6c60961
MD5 a0cadb06fa78983e98f1925f0a0f76f2
SHA1 c7cc12e88054fb0295fbaa3da2c5a1e82649ca9c
SHA512 8c067c00ddc760ae46003be287288b032254081bfc878302928a6c4e1fe2c37e6f04ae31a88b066244d04eb9eaf19de3d08bf03f688b38c8264c5011c720afdf
SSDEEP 3072:lQAoogIIId5KtbY3Pztjcf8/GCtvg3pnrjHeLVhVKe78/+BP5Hll:lQboBbKtQPJjcfLZupKeoWBP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-4446.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4446.exe
Size 468KB
SHA256 43dbaf6838fee8f7d8358a13a3ccd220f03dc2fc363409ee07d0df48c4fd1252
MD5 efb10bcd7a9aeea9120158d33338cff2
SHA1 842e2d49ab71dbcbd3018234c293407591103c52
SHA512 6681d40ab546be234658d039e5673ee3be8075a3cd17e504ad63a14b369131d528beebfd7b0f3142482feb0acc6c46dbb47d28472539867a3df0dd21365bd5cb
SSDEEP 3072:lQAoogIIId5KtbY3Pztjcf8/GCtvg3pnrjHeLVhOKe78/rBP5Hl1:lQboBbKtQPJjcfLZuCKeoDBP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-47050.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47050.exe
Size 468KB
SHA256 be2f7acba041184cfe54c6c533271cfed14c0ebd3f757b8db65353ad521b0147
MD5 52f9050a58c2c6101c8451078f29972e
SHA1 43e1b83b599d61d527ed44d8b4a8e7b7f329899e
SHA512 824c2471bbf4769341488fff4c779e0739275819ba23974588f4578278dfa20d5a0accd11c61724ae37ca9fa594a18118ebf38ef83b49ea5534d5cbc26d036e0
SSDEEP 3072:lQAoogIIId5KtbY3Pztjcf8/GCtvg3pnrjHeLVhOKeB8/+BPXHlC:lQboBbKtQPJjcfLZuCKeOWBPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-50383.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50383.exe
Size 468KB
SHA256 aa249efdc54ce420bbe78a6bc1b5e15a37e7f964d6a529063a740cb1a4d0aef8
MD5 eac8cc4dfab5768a7a26f8bf56da8468
SHA1 fbda0f74c4769633c6669883a99c1f3cb13bbd9e
SHA512 2a96e4f48107e54ab0b74bca10f246b90fc079369134e6df7f6f69f164182d0fc2aa8b955e53f939a0621dbed0c82a1f3ba89ef8c924fbb8e81486309770830a
SSDEEP 3072:lQAoogIIId5KtbY3Pztjcf8/GCtvg3pnrjHeLVhVKe78/3BP5HlC:lQboBbKtQPJjcfLZupKeoPBP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-53180.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53180.exe
Size 468KB
SHA256 67df104c002f508bdb067233bae6c790ddfd073a02b3b78cd5f7f46c5772e10c
MD5 47fdadfe8b50eeb9450195e6ca7d7de6
SHA1 7599fd97ae6350ee7885c29179a6bab129b3948f
SHA512 bedc93467a107c4dd1d2fee5db420e7db241b30ddfbc779e426f4ddef81a26092692580d1cd30ac2861c1194d6c87fe5d367b9a0e5cc389c1edd54c5d1f48531
SSDEEP 3072:lQAoogIIId5KtbY3Pztjcf8/GCtvg3pnrjHeLVhVKe78/3PP5HlC:lQboBbKtQPJjcfLZupKeoPPP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-21529.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-21529.exe
Size 468KB
SHA256 3cdf74eb92c4f86c7a9d28fbd69137d3e47d636607d8e80f3c20a91884fcb624
MD5 1273f28d89c519ef68f987ba7405b14c
SHA1 0f9e13ea076e07f734db52675652fe78d8ca1767
SHA512 5678229f9f7eb231c196f05da78d571235fd34ddcf21a010b3d5c17e37b58f0be7c15c33c26839ed410c556b1cc0cded0191a34646e988c9f3cddeac4cc297c8
SSDEEP 3072:lQAoogIIId5KtbY3Pztjcf8/GCtvg3pnrjHeLVhOKe78/+rPX9lC:lQboBbKtQPJjcfLZuCKeoWrPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-26538.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
Size 468KB
SHA256 88aeb754af997a60c26c39909781970d319e89d13dde902504e1fe2dbb7d046e
MD5 205e7cad5f52f24b2ac5f7b2a33aaa10
SHA1 892efee5a4c12e33aee033f22559f8285d9485e9
SHA512 12aedf79aa26addfcf83c46f263032dc95452a0771cc234a1b20434b886d9739d9b7d422924a5ede2f0849e791fd08cc2a6c284c2dd01a4b97d43fc64e56616a
SSDEEP 3072:lQAoogIIId5KtbY3Pztjcf8/GCtvg3pnrjHeLxhOKe78/7WPXHlC:lQboBbKtQPJjcfLZuOKeoDWPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-30430.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-30430.exe
Size 468KB
SHA256 9061ec7ff6c5ab5baa092a2c476f86664d88d7be4718f64df11b01c36237abea
MD5 45be4d0c2f82e83ee7a50cd05040f707
SHA1 4e1a51c402e54b4d71e23defbfcd81645960e772
SHA512 f48209a8438f8c64dfcbba2baed810b1afdb57e29628da68961370b3d4db7c1ccf776b989207680f9579fa9a2de39b577edbea4c9dd848ebad687d31f40c25c6
SSDEEP 3072:lQAoogIIId5KtbY3Mztjcf8/GCtvg3pnrjHeLVhcKe78/+BP5HlC:lQboBbKtQMJjcfLZugKeoWBP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-30517.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-30517.exe
Size 468KB
SHA256 0096f8efb9bb2867d6abb4c43fa62c23661e692bd2ae4b9beac6ae1fd6e5a3b3
MD5 34f65ebd1ec5500ee8543da9718591ed
SHA1 ea4d666aac90f31b558cce20153a107bcbcb1fdd
SHA512 c8e2a2cd4ab0e32abcc1a37a50173da492cfafbef20ef9a057d707d745c8e64c98660cd1e359c812a8f006bd9fa286779eeaa0a0fb6b76611214eb53f7cbba9f
SSDEEP 3072:lQAoogIIId5KtbY3Pztjcf8/GCtvg3pnrjHeLVhOKe78/+BPX9lC:lQboBbKtQPJjcfLZuCKeoWBPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-41011.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-41011.exe
Size 468KB
SHA256 eca2cd625a1c0f7b8674c3d25745eebab6aceb33cce6d24a28b3f1aa533ca190
MD5 141b1b3b857ad6f9c19a4486e1c68a50
SHA1 af2e188e7c31ff95c2d1c48fa865355a03c7369a
SHA512 6a32a6154ae90c35af6eb2ef67047728d9eb532f7013d26d7a873a8e270fbad480dacfffb2be5d8f539201e31a226fee9f10bb7658f2c1bb99f632b101cbfc21
SSDEEP 3072:lQAoogIIId5KtbY3Pztjcf8/GCtvg3pnrjHeLVhOKev8o+BPX9lC:lQboBbKtQPJjcfLZuCKeknBPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-46958.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-46958.exe
Size 468KB
SHA256 1970e20df2c3f14c5d040429b0309317fa0236fcef38284061db6a822d1f2c54
MD5 0028aa38598b47539263d7edbe1c1516
SHA1 18cfb68584b3aabbfeac267735a25f200bac69c3
SHA512 ddbabe05116ed81ba8c064e387a52de049cde4a4638f388a2ce4498a26e5e0fe194a9f78c71fff6ab7131f103cf899585235484e36ac93436548632139386a4c
SSDEEP 3072:lQAoogIIId5KtbY3Pztjcf8/GCtvg3pnrjHeLVhOKe78o+BPX9lC:lQboBbKtQPJjcfLZuCKeonBPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-48437.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-48437.exe
Size 468KB
SHA256 27d39d3bed9c2b1dcfd557839401125fcaeff89984100ed51ff6fe888aa429fb
MD5 9ad4f9821328c6f4ce19e535ab2065a6
SHA1 c782b09f1d370a9a86f14679f12a1d317c92e674
SHA512 ea73917f1f043cc610fb52e29be51bb92176a9b4789b7350505c2615741402aea0372bbf9cadccb6ac0296af0512a57e44758abe6bacdceed7c2f93c692367a3
SSDEEP 3072:lQAoogIIId5KtbY3Pztjcf8/GCtvg3pnrjHeLVhOKe78/7WPXHlC:lQboBbKtQPJjcfLZuCKeoDWPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-51369.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-51369.exe
Size 468KB
SHA256 26b0fb80353e272a076ff9b44c0166bd4da28a3b0b5871fe6e81bb6c8ffde059
MD5 32fab00060d635f21559bb2be4e1d6db
SHA1 b2699ff2f1413a151ccdedc5a6da940a4d500fb1
SHA512 310db05fe2a286d13fe1ebeb4bedc9dca1cbe31c81dade1aea1097ad2c5fc46061d69400583027889b94fd6e1ad84fb7a6fe165adb7777356553640d087e374c
SSDEEP 3072:lQAoogIIId5KtbY3Pztjcf8/GCtvg3pnrjHeLVhOKe78/+WPXHlC:lQboBbKtQPJjcfLZuCKeoWWPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-57508.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-57508.exe
Size 468KB
SHA256 e21841d539f99ce9d99db9c0d8ad600579d03d1308d28a7ea54a51531b31c67e
MD5 86a9d46b940ef684dc424b86af1576ed
SHA1 51c86d1653c8085cc33b6bf280bfb76db3c6c405
SHA512 6a8f868fe7eb17dfbe26013dc6684f4586c62fc00330d17b34965333e219a688b16a6bce4ad12265185c9676b1d640d7d866b844a6ede455cf8d2a9a83ad967b
SSDEEP 3072:lQAoogIIId5KtbY3Pztjcf8/GCtvg3pnrjHeLVhOKe78/+BPXHlC:lQboBbKtQPJjcfLZuCKeoWBPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-777.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-777.exe
Size 468KB
SHA256 f3b1211f50d840dfbeb9aaef2cf5731cb33d62d11d1cc91d9df41e84c62c969b
MD5 f8ac55064add402163386cf650b4d50a
SHA1 222f6ff499ccd36148cf7e22bd84d11741e19cb1
SHA512 83a6b3834715813e20f541961787c219b0fee017cd44356e6d92a84b7956ac0fd2049b567a551588d636d550c209a4e387863e11d64389f3c2ee78469bffc23a
SSDEEP 3072:lQAoogIIId5KtbY3Pztjcf8/GCtvg3pnrjHeLVhVKe78/+BP5HlC:lQboBbKtQPJjcfLZupKeoWBP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/268-369-0x0000000002880000-0x00000000028F5000-memory.dmp

Download

memory/268-174-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/620-331-0x0000000001D10000-0x0000000001D85000-memory.dmp

Download

memory/620-201-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/620-330-0x0000000001D10000-0x0000000001D85000-memory.dmp

Download

memory/904-250-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/996-400-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1048-352-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1156-285-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1364-251-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1540-386-0x00000000002F0000-0x0000000000365000-memory.dmp

Download

memory/1540-387-0x00000000002F0000-0x0000000000365000-memory.dmp

Download

memory/1540-176-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1620-415-0x00000000029D0000-0x0000000002A45000-memory.dmp

Download

memory/1620-230-0x00000000029D0000-0x0000000002A45000-memory.dmp

Download

memory/1620-228-0x00000000029D0000-0x0000000002A45000-memory.dmp

Download

memory/1620-173-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1684-133-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1684-398-0x0000000002210000-0x0000000002285000-memory.dmp

Download

memory/1684-399-0x0000000002210000-0x0000000002285000-memory.dmp

Download

memory/1716-401-0x0000000002640000-0x00000000026B5000-memory.dmp

Download

memory/1716-129-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1716-397-0x0000000002640000-0x00000000026B5000-memory.dmp

Download

memory/1748-301-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1816-298-0x00000000026E0000-0x0000000002755000-memory.dmp

Download

memory/1816-111-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1816-306-0x00000000026E0000-0x0000000002755000-memory.dmp

Download

memory/1884-249-0x0000000002540000-0x00000000025B5000-memory.dmp

Download

memory/1884-141-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2088-307-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2112-152-0x00000000024B0000-0x0000000002525000-memory.dmp

Download

memory/2112-26-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2112-391-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2112-242-0x00000000024B0000-0x0000000002525000-memory.dmp

Download

memory/2112-247-0x00000000024B0000-0x0000000002525000-memory.dmp

Download

memory/2112-168-0x00000000024B0000-0x0000000002525000-memory.dmp

Download

memory/2112-64-0x00000000024B0000-0x0000000002525000-memory.dmp

Download

memory/2272-282-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2284-361-0x0000000002730000-0x00000000027A5000-memory.dmp

Download

memory/2284-357-0x0000000002730000-0x00000000027A5000-memory.dmp

Download

memory/2284-212-0x0000000002730000-0x00000000027A5000-memory.dmp

Download

memory/2284-211-0x0000000002730000-0x00000000027A5000-memory.dmp

Download

memory/2284-92-0x0000000002730000-0x00000000027A5000-memory.dmp

Download

memory/2284-69-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2320-229-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2320-385-0x0000000000320000-0x0000000000395000-memory.dmp

Download

memory/2376-402-0x00000000025A0000-0x0000000002615000-memory.dmp

Download

memory/2376-83-0x00000000025A0000-0x0000000002615000-memory.dmp

Download

memory/2376-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2376-257-0x00000000025A0000-0x0000000002615000-memory.dmp

Download

memory/2376-277-0x00000000025A0000-0x0000000002615000-memory.dmp

Download

memory/2376-350-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2376-151-0x00000000025A0000-0x0000000002615000-memory.dmp

Download

memory/2376-6-0x00000000025A0000-0x0000000002615000-memory.dmp

Download

memory/2376-170-0x00000000025A0000-0x0000000002615000-memory.dmp

Download

memory/2428-302-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2468-332-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2476-281-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2604-371-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2616-167-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2616-272-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2616-169-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2616-253-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2616-85-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2644-389-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2648-390-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2716-128-0x00000000024F0000-0x0000000002565000-memory.dmp

Download

memory/2716-63-0x00000000024F0000-0x0000000002565000-memory.dmp

Download

memory/2716-290-0x00000000024F0000-0x0000000002565000-memory.dmp

Download

memory/2716-36-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2716-130-0x00000000024F0000-0x0000000002565000-memory.dmp

Download

memory/2716-414-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2716-299-0x00000000024F0000-0x0000000002565000-memory.dmp

Download

memory/2736-342-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2740-255-0x00000000025B0000-0x0000000002625000-memory.dmp

Download

memory/2740-276-0x00000000025B0000-0x0000000002625000-memory.dmp

Download

memory/2740-68-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2796-286-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2864-362-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2920-351-0x0000000001FC0000-0x0000000002035000-memory.dmp

Download

memory/2920-214-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2960-125-0x00000000026A0000-0x0000000002715000-memory.dmp

Download

memory/2960-283-0x00000000026A0000-0x0000000002715000-memory.dmp

Download

memory/2960-388-0x00000000026A0000-0x0000000002715000-memory.dmp

Download

memory/2960-25-0x00000000026A0000-0x0000000002715000-memory.dmp

Download

memory/2960-370-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2960-22-0x00000000026A0000-0x0000000002715000-memory.dmp

Download

memory/2960-131-0x00000000026A0000-0x0000000002715000-memory.dmp

Download

memory/2960-284-0x00000000026A0000-0x0000000002715000-memory.dmp

Download

memory/2968-288-0x0000000001CD0000-0x0000000001D45000-memory.dmp

Download

memory/2968-66-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2968-300-0x0000000001CD0000-0x0000000001D45000-memory.dmp

Download

memory/3052-198-0x00000000026B0000-0x0000000002725000-memory.dmp

Download

memory/3052-340-0x00000000026B0000-0x0000000002725000-memory.dmp

Download

memory/3052-341-0x00000000026B0000-0x0000000002725000-memory.dmp

Download

memory/3052-199-0x00000000026B0000-0x0000000002725000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads