012968299959d2d5edc1051121683e6e6df152029bf995a9d21ee4a6ed0f3ff7

Analysis

max time kernel
119s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e48a5926c05ced59c40e15b25c32110N.exe
Size

468KB
MD5

0e48a5926c05ced59c40e15b25c32110
SHA1

a124cfb240ae1d807e73a9b4b53c8bf01fa49ce0
SHA256

012968299959d2d5edc1051121683e6e6df152029bf995a9d21ee4a6ed0f3ff7
SHA512

50509cdb154ca310bcd9a83bc726c62bd38233a42bfaa305657d9b2392b7ed2f895d453734783f9a442495a6b7f4e627d41a396ae724becf2716d42f38d3e715
SSDEEP

3072:O1n2ogLday8Un+HsPz5Fvf1cfhjWI8JnmHevVpB02h3Ih5NTNl1:O12o9LUnfP1Fvf/xPZ02ZU5NT

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3192	Unicorn-64569.exe
1956	Unicorn-45109.exe
3640	Unicorn-21159.exe
3948	Unicorn-5228.exe
1668	Unicorn-1144.exe
3132	Unicorn-46816.exe
3180	Unicorn-57043.exe
2548	Unicorn-49935.exe
2024	Unicorn-25985.exe
3572	Unicorn-29323.exe
1356	Unicorn-25239.exe
1188	Unicorn-60049.exe
1776	Unicorn-55700.exe
1264	Unicorn-32015.exe
4948	Unicorn-45751.exe
4012	Unicorn-42691.exe
4964	Unicorn-21455.exe
916	Unicorn-29069.exe
3720	Unicorn-6410.exe
3988	Unicorn-26931.exe
4568	Unicorn-43167.exe
3260	Unicorn-49297.exe
4160	Unicorn-56074.exe
2568	Unicorn-41129.exe
884	Unicorn-43822.exe
2368	Unicorn-28877.exe
1056	Unicorn-20517.exe
1520	Unicorn-38229.exe
1196	Unicorn-47159.exe
1064	Unicorn-62104.exe
2880	Unicorn-12083.exe
4232	Unicorn-23423.exe
4504	Unicorn-49.exe
216	Unicorn-26137.exe
4044	Unicorn-34204.exe
1712	Unicorn-28083.exe
3384	Unicorn-57226.exe
5036	Unicorn-56671.exe
3364	Unicorn-13500.exe
3000	Unicorn-23542.exe
4912	Unicorn-4517.exe
2516	Unicorn-13884.exe
4224	Unicorn-5716.exe
2060	Unicorn-59001.exe
764	Unicorn-59001.exe
4408	Unicorn-35627.exe
4332	Unicorn-10468.exe
1560	Unicorn-16599.exe
1644	Unicorn-47060.exe
3588	Unicorn-47325.exe
2432	Unicorn-35073.exe
1128	Unicorn-30989.exe
4772	Unicorn-11123.exe
2240	Unicorn-51501.exe
3632	Unicorn-53355.exe
792	Unicorn-22629.exe
5072	Unicorn-13698.exe
3660	Unicorn-2763.exe
2456	Unicorn-45187.exe
3232	Unicorn-15637.exe
3092	Unicorn-21237.exe
1252	Unicorn-34972.exe
1040	Unicorn-51964.exe
2136	Unicorn-29235.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
5548	1712	WerFault.exe	129
5668	1252	WerFault.exe	155
5904	4336	WerFault.exe	160
6340	4528	WerFault.exe	166
10132	5836	WerFault.exe	215
16872	916	WerFault.exe	111

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e48a5926c05ced59c40e15b25c32110N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9857.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5524	dwm.exe
Token: SeChangeNotifyPrivilege	5524	dwm.exe
Token: 33	5524	dwm.exe
Token: SeIncBasePriorityPrivilege	5524	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3012	0e48a5926c05ced59c40e15b25c32110N.exe
3192	Unicorn-64569.exe
1956	Unicorn-45109.exe
3640	Unicorn-21159.exe
3948	Unicorn-5228.exe
3132	Unicorn-46816.exe
3180	Unicorn-57043.exe
1668	Unicorn-1144.exe
2548	Unicorn-49935.exe
2024	Unicorn-25985.exe
3572	Unicorn-29323.exe
1264	Unicorn-32015.exe
1356	Unicorn-25239.exe
1776	Unicorn-55700.exe
1188	Unicorn-60049.exe
4948	Unicorn-45751.exe
4012	Unicorn-42691.exe
4964	Unicorn-21455.exe
916	Unicorn-29069.exe
3720	Unicorn-6410.exe
3988	Unicorn-26931.exe
4568	Unicorn-43167.exe
3260	Unicorn-49297.exe
2568	Unicorn-41129.exe
4160	Unicorn-56074.exe
884	Unicorn-43822.exe
2880	Unicorn-12083.exe
1520	Unicorn-38229.exe
1056	Unicorn-20517.exe
2368	Unicorn-28877.exe
1064	Unicorn-62104.exe
1196	Unicorn-47159.exe
4504	Unicorn-49.exe
4232	Unicorn-23423.exe
216	Unicorn-26137.exe
4044	Unicorn-34204.exe
1712	Unicorn-28083.exe
3384	Unicorn-57226.exe
5036	Unicorn-56671.exe
3000	Unicorn-23542.exe
3364	Unicorn-13500.exe
4912	Unicorn-4517.exe
2516	Unicorn-13884.exe
4224	Unicorn-5716.exe
4408	Unicorn-35627.exe
764	Unicorn-59001.exe
2060	Unicorn-59001.exe
4332	Unicorn-10468.exe
1644	Unicorn-47060.exe
3092	Unicorn-21237.exe
1040	Unicorn-51964.exe
2240	Unicorn-51501.exe
3632	Unicorn-53355.exe
792	Unicorn-22629.exe
1252	Unicorn-34972.exe
2432	Unicorn-35073.exe
1128	Unicorn-30989.exe
1560	Unicorn-16599.exe
3588	Unicorn-47325.exe
3232	Unicorn-15637.exe
5072	Unicorn-13698.exe
2456	Unicorn-45187.exe
4772	Unicorn-11123.exe
3660	Unicorn-2763.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3192	3012	0e48a5926c05ced59c40e15b25c32110N.exe	89
PID 3012 wrote to memory of 3192	3012	0e48a5926c05ced59c40e15b25c32110N.exe	89
PID 3012 wrote to memory of 3192	3012	0e48a5926c05ced59c40e15b25c32110N.exe	89
PID 3192 wrote to memory of 1956	3192	Unicorn-64569.exe	92
PID 3192 wrote to memory of 1956	3192	Unicorn-64569.exe	92
PID 3192 wrote to memory of 1956	3192	Unicorn-64569.exe	92
PID 3012 wrote to memory of 3640	3012	0e48a5926c05ced59c40e15b25c32110N.exe	93
PID 3012 wrote to memory of 3640	3012	0e48a5926c05ced59c40e15b25c32110N.exe	93
PID 3012 wrote to memory of 3640	3012	0e48a5926c05ced59c40e15b25c32110N.exe	93
PID 1956 wrote to memory of 3948	1956	Unicorn-45109.exe	95
PID 1956 wrote to memory of 3948	1956	Unicorn-45109.exe	95
PID 1956 wrote to memory of 3948	1956	Unicorn-45109.exe	95
PID 3640 wrote to memory of 1668	3640	Unicorn-21159.exe	97
PID 3640 wrote to memory of 1668	3640	Unicorn-21159.exe	97
PID 3640 wrote to memory of 1668	3640	Unicorn-21159.exe	97
PID 3192 wrote to memory of 3132	3192	Unicorn-64569.exe	98
PID 3192 wrote to memory of 3132	3192	Unicorn-64569.exe	98
PID 3192 wrote to memory of 3132	3192	Unicorn-64569.exe	98
PID 3012 wrote to memory of 3180	3012	0e48a5926c05ced59c40e15b25c32110N.exe	99
PID 3012 wrote to memory of 3180	3012	0e48a5926c05ced59c40e15b25c32110N.exe	99
PID 3012 wrote to memory of 3180	3012	0e48a5926c05ced59c40e15b25c32110N.exe	99
PID 3948 wrote to memory of 2548	3948	Unicorn-5228.exe	101
PID 3948 wrote to memory of 2548	3948	Unicorn-5228.exe	101
PID 3948 wrote to memory of 2548	3948	Unicorn-5228.exe	101
PID 1956 wrote to memory of 2024	1956	Unicorn-45109.exe	102
PID 1956 wrote to memory of 2024	1956	Unicorn-45109.exe	102
PID 1956 wrote to memory of 2024	1956	Unicorn-45109.exe	102
PID 3132 wrote to memory of 3572	3132	Unicorn-46816.exe	103
PID 3132 wrote to memory of 3572	3132	Unicorn-46816.exe	103
PID 3132 wrote to memory of 3572	3132	Unicorn-46816.exe	103
PID 1668 wrote to memory of 1356	1668	Unicorn-1144.exe	104
PID 1668 wrote to memory of 1356	1668	Unicorn-1144.exe	104
PID 1668 wrote to memory of 1356	1668	Unicorn-1144.exe	104
PID 3180 wrote to memory of 1188	3180	Unicorn-57043.exe	105
PID 3180 wrote to memory of 1188	3180	Unicorn-57043.exe	105
PID 3180 wrote to memory of 1188	3180	Unicorn-57043.exe	105
PID 3012 wrote to memory of 1776	3012	0e48a5926c05ced59c40e15b25c32110N.exe	106
PID 3012 wrote to memory of 1776	3012	0e48a5926c05ced59c40e15b25c32110N.exe	106
PID 3012 wrote to memory of 1776	3012	0e48a5926c05ced59c40e15b25c32110N.exe	106
PID 3640 wrote to memory of 1264	3640	Unicorn-21159.exe	108
PID 3640 wrote to memory of 1264	3640	Unicorn-21159.exe	108
PID 3640 wrote to memory of 1264	3640	Unicorn-21159.exe	108
PID 3192 wrote to memory of 4948	3192	Unicorn-64569.exe	107
PID 3192 wrote to memory of 4948	3192	Unicorn-64569.exe	107
PID 3192 wrote to memory of 4948	3192	Unicorn-64569.exe	107
PID 2548 wrote to memory of 4012	2548	Unicorn-49935.exe	109
PID 2548 wrote to memory of 4012	2548	Unicorn-49935.exe	109
PID 2548 wrote to memory of 4012	2548	Unicorn-49935.exe	109
PID 3948 wrote to memory of 4964	3948	Unicorn-5228.exe	110
PID 3948 wrote to memory of 4964	3948	Unicorn-5228.exe	110
PID 3948 wrote to memory of 4964	3948	Unicorn-5228.exe	110
PID 2024 wrote to memory of 916	2024	Unicorn-25985.exe	111
PID 2024 wrote to memory of 916	2024	Unicorn-25985.exe	111
PID 2024 wrote to memory of 916	2024	Unicorn-25985.exe	111
PID 1956 wrote to memory of 3720	1956	Unicorn-45109.exe	112
PID 1956 wrote to memory of 3720	1956	Unicorn-45109.exe	112
PID 1956 wrote to memory of 3720	1956	Unicorn-45109.exe	112
PID 1264 wrote to memory of 3988	1264	Unicorn-32015.exe	113
PID 1264 wrote to memory of 3988	1264	Unicorn-32015.exe	113
PID 1264 wrote to memory of 3988	1264	Unicorn-32015.exe	113
PID 3640 wrote to memory of 4568	3640	Unicorn-21159.exe	115
PID 3640 wrote to memory of 4568	3640	Unicorn-21159.exe	115
PID 3640 wrote to memory of 4568	3640	Unicorn-21159.exe	115
PID 3572 wrote to memory of 3260	3572	Unicorn-29323.exe	114

C:\Users\Admin\AppData\Local\Temp\0e48a5926c05ced59c40e15b25c32110N.exe
"C:\Users\Admin\AppData\Local\Temp\0e48a5926c05ced59c40e15b25c32110N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45109.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45109.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49935.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42691.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55685.exe
        8⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        9⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe
        10⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48996.exe
        10⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2726.exe
        10⤵
        
        PID:14532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64943.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54423.exe
        9⤵
        
        PID:9544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        9⤵
        
        PID:13280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
        9⤵
        
        PID:16204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35269.exe
        8⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34911.exe
        9⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27227.exe
        10⤵
        
        PID:13176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16099.exe
        10⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
        9⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11000.exe
        9⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        9⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30278.exe
        8⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        8⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        8⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31193.exe
        8⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21429.exe
        7⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        8⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31533.exe
        9⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63053.exe
        9⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16666.exe
        9⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7936.exe
        8⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        8⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32121.exe
        8⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
        7⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        8⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
        8⤵
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60859.exe
        8⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-433.exe
        7⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20050.exe
        7⤵
        
        PID:12704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39642.exe
        7⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29235.exe
        7⤵
        Executes dropped EXE
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40439.exe
        8⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14045.exe
        9⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11933.exe
        9⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        9⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62706.exe
        8⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25.exe
        8⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63936.exe
        7⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        8⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        8⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39112.exe
        8⤵
        
        PID:15592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
        7⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58115.exe
        7⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        7⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35165.exe
        6⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 492
        7⤵
        Program crash
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21673.exe
        6⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
        7⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        7⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
        7⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12318.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe
        6⤵
        
        PID:13892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47618.exe
        6⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21455.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26137.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16791.exe
        7⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62421.exe
        8⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65275.exe
        9⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4310.exe
        10⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49100.exe
        10⤵
        
        PID:14524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        10⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
        9⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
        9⤵
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62898.exe
        8⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
        8⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        8⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20381.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15883.exe
        8⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50963.exe
        9⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25939.exe
        9⤵
        
        PID:15796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36520.exe
        9⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40251.exe
        8⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
        8⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        8⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57923.exe
        7⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31128.exe
        7⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56240.exe
        6⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        7⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4040.exe
        8⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26511.exe
        9⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50880.exe
        9⤵
        
        PID:13164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47174.exe
        9⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61082.exe
        8⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48088.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        8⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32197.exe
        7⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        8⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
        8⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        8⤵
        
        PID:16492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        7⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32560.exe
        7⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
        6⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65275.exe
        7⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        8⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22649.exe
        8⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        8⤵
        
        PID:17368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
        7⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38523.exe
        7⤵
        
        PID:14836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe
        7⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-625.exe
        6⤵
        
        PID:8828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64783.exe
        6⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34204.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41295.exe
        6⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45737.exe
        7⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38851.exe
        8⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        9⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
        9⤵
        
        PID:14024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40350.exe
        9⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35207.exe
        8⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50199.exe
        8⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        8⤵
        
        PID:17400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59032.exe
        7⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36765.exe
        8⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59078.exe
        8⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39742.exe
        7⤵
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59660.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22105.exe
        7⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        7⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39112.exe
        7⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
        6⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28950.exe
        6⤵
        
        PID:13196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        6⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4849.exe
        5⤵
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        7⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        7⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20061.exe
        7⤵
        
        PID:15956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9498.exe
        6⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
        6⤵
        
        PID:12864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48168.exe
        6⤵
        
        PID:16072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56013.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18815.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40901.exe
        7⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14123.exe
        7⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
        7⤵
        
        PID:12776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44771.exe
        6⤵
        
        PID:14176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17295.exe
        6⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        5⤵
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42323.exe
        6⤵
        
        PID:14584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        6⤵
        
        PID:8588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29351.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14722.exe
        5⤵
        
        PID:14816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64883.exe
        5⤵
        
        PID:16436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29069.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28083.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 720
        7⤵
        Program crash
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63038.exe
        6⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 720
        7⤵
        Program crash
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1060.exe
        6⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5836 -s 620
        7⤵
        Program crash
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22800.exe
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54285.exe
        6⤵
        
        PID:11732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
        6⤵
        
        PID:15644
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 740
        6⤵
        Program crash
        
        PID:16872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57226.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2400.exe
        6⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45737.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        8⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        8⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        8⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52194.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8845.exe
        7⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62731.exe
        7⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39318.exe
        7⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52194.exe
        7⤵
        
        PID:16212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63936.exe
        6⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17829.exe
        7⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        7⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56626.exe
        7⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58315.exe
        6⤵
        
        PID:9964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        6⤵
        
        PID:12536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
        6⤵
        
        PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64521.exe
        5⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
        6⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30683.exe
        7⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23065.exe
        8⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43349.exe
        8⤵
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37729.exe
        8⤵
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        8⤵
        
        PID:17380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        7⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12544.exe
        7⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51172.exe
        7⤵
        
        PID:16228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
        6⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        7⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9821.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        7⤵
        
        PID:15820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        6⤵
        
        PID:11252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35312.exe
        6⤵
        
        PID:16248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9016.exe
        6⤵
        
        PID:16056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13339.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
        6⤵
        
        PID:15132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57305.exe
        5⤵
        
        PID:9168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34241.exe
        5⤵
        
        PID:12548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52537.exe
        5⤵
        
        PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6410.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56671.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17367.exe
        6⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        7⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
        8⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        8⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55753.exe
        8⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34578.exe
        7⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4943.exe
        7⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53502.exe
        7⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18435.exe
        6⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        7⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
        7⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        7⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
        6⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57923.exe
        6⤵
        
        PID:13720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
        6⤵
        
        PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
        5⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        7⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45125.exe
        8⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24377.exe
        8⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63162.exe
        8⤵
        
        PID:12792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10510.exe
        7⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38301.exe
        7⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27127.exe
        6⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19752.exe
        6⤵
        
        PID:10800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35042.exe
        6⤵
        
        PID:14676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        6⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28086.exe
        5⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        6⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17719.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        6⤵
        
        PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-433.exe
        5⤵
        
        PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20050.exe
        5⤵
        
        PID:12752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23542.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23397.exe
        5⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40247.exe
        6⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        7⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        7⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
        7⤵
        
        PID:15340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        7⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32327.exe
        6⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        6⤵
        
        PID:12200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52194.exe
        6⤵
        
        PID:16012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62679.exe
        5⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28265.exe
        6⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        6⤵
        
        PID:12636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64943.exe
        6⤵
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29152.exe
        5⤵
        
        PID:9460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62775.exe
        5⤵
        
        PID:13832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        5⤵
        
        PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32940.exe
      4⤵
      PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39707.exe
        5⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
        6⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
        7⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47180.exe
        7⤵
        
        PID:13384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18585.exe
        7⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41237.exe
        6⤵
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21418.exe
        6⤵
        
        PID:13496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        6⤵
        
        PID:16644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
        5⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        6⤵
        
        PID:10560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
        6⤵
        
        PID:14456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        6⤵
        
        PID:16440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4978.exe
        5⤵
        
        PID:11024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32790.exe
        5⤵
        
        PID:15864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
        5⤵
        
        PID:15632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
      4⤵
      PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38441.exe
        5⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        5⤵
        
        PID:10248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28600.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64576.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57835.exe
      4⤵
      PID:8076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
      4⤵
      PID:12640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37949.exe
      4⤵
      PID:16076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51594.exe
      4⤵
      PID:1168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46816.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49297.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13604.exe
        8⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30033.exe
        9⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6552.exe
        10⤵
        
        PID:13556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        10⤵
        
        PID:17172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        9⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49226.exe
        9⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34309.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        8⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17719.exe
        8⤵
        
        PID:15528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50506.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39017.exe
        8⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
        8⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        8⤵
        
        PID:16336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        8⤵
        
        PID:16508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39493.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47190.exe
        7⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42804.exe
        7⤵
        
        PID:16252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8191.exe
        6⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20019.exe
        7⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe
        8⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36267.exe
        9⤵
        
        PID:15592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4248.exe
        9⤵
        
        PID:16816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        8⤵
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25.exe
        8⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23811.exe
        7⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        7⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12277.exe
        7⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29046.exe
        6⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50117.exe
        7⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22235.exe
        8⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        8⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13961.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38331.exe
        7⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
        7⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16858.exe
        7⤵
        
        PID:15340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37792.exe
        6⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47673.exe
        7⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51622.exe
        7⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        7⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2178.exe
        6⤵
        
        PID:11132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42321.exe
        6⤵
        
        PID:14864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        6⤵
        
        PID:16688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35627.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16189.exe
        6⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        7⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46993.exe
        8⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6017.exe
        8⤵
        
        PID:10784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29176.exe
        8⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        8⤵
        
        PID:16732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
        7⤵
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11933.exe
        7⤵
        
        PID:13924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
        7⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3993.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31620.exe
        6⤵
        
        PID:11112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
        6⤵
        
        PID:14848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        6⤵
        
        PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64459.exe
        5⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62130.exe
        6⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3416.exe
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34466.exe
        6⤵
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        6⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52566.exe
        5⤵
        
        PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
        5⤵
        
        PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9265.exe
        5⤵
        
        PID:15200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15967.exe
        5⤵
        
        PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56074.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5716.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
        6⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7574.exe
        7⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26189.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe
        8⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17911.exe
        8⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        8⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22405.exe
        7⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11933.exe
        7⤵
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe
        7⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19779.exe
        6⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14045.exe
        7⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11933.exe
        7⤵
        
        PID:13948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43004.exe
        7⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9498.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18409.exe
        6⤵
        
        PID:12904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27490.exe
        6⤵
        
        PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30557.exe
        5⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43707.exe
        6⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23797.exe
        7⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        7⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8690.exe
        7⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46831.exe
        6⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22183.exe
        7⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59380.exe
        7⤵
        
        PID:15948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        7⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49712.exe
        6⤵
        
        PID:12912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4932.exe
        6⤵
        
        PID:16088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29046.exe
        5⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        6⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40086.exe
        6⤵
        
        PID:15968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        6⤵
        
        PID:16484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53910.exe
        5⤵
        
        PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64783.exe
        5⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56808.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
        5⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9878.exe
        6⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45369.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49318.exe
        7⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47174.exe
        7⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42415.exe
        6⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63629.exe
        6⤵
        
        PID:13800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16858.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48534.exe
        5⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58877.exe
        6⤵
        
        PID:13440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18062.exe
        6⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14133.exe
        5⤵
        
        PID:10436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27490.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47610.exe
      4⤵
      PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        5⤵
        
        PID:8180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        5⤵
        
        PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26667.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
      4⤵
      PID:8144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49617.exe
      4⤵
      PID:11588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39543.exe
      4⤵
      PID:15612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4681.exe
      4⤵
      PID:16248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45751.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45751.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20517.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45187.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25346.exe
        6⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
        7⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        7⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        7⤵
        
        PID:15604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13801.exe
        6⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21358.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58565.exe
        6⤵
        
        PID:14484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49354.exe
        5⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22105.exe
        6⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3018.exe
        7⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
        7⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        6⤵
        
        PID:11728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60362.exe
        6⤵
        
        PID:12788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60297.exe
        5⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
        5⤵
        
        PID:10236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35312.exe
        5⤵
        
        PID:16240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19130.exe
        5⤵
        
        PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        5⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59463.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29033.exe
        7⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27984.exe
        8⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47180.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47174.exe
        7⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10319.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
        6⤵
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46215.exe
        6⤵
        
        PID:15308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40749.exe
        5⤵
        
        PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29090.exe
        5⤵
        
        PID:16144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe
        5⤵
        
        PID:16516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
      4⤵
      PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34549.exe
        5⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14040.exe
        6⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20127.exe
        6⤵
        
        PID:13396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        5⤵
        
        PID:10892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-396.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21964.exe
        5⤵
        
        PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62078.exe
      4⤵
      PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64783.exe
      4⤵
      PID:11804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
      4⤵
      PID:2560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10459.exe
        5⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17829.exe
        6⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        6⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50392.exe
        6⤵
        
        PID:15628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25.exe
        6⤵
        
        PID:336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35601.exe
        5⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20813.exe
        6⤵
        
        PID:12852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41160.exe
        5⤵
        
        PID:12196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
        5⤵
        
        PID:15376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe
        5⤵
        
        PID:16824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61030.exe
      4⤵
      PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38441.exe
        5⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24491.exe
        5⤵
        
        PID:9932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
        5⤵
        
        PID:15120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        5⤵
        
        PID:16700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11096.exe
      4⤵
      PID:8640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41160.exe
      4⤵
      PID:12316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
      4⤵
      PID:15604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
      4⤵
      PID:15756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13698.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13698.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exe
      4⤵
      PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        5⤵
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        5⤵
        
        PID:10332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35207.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        5⤵
        
        PID:16668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe
      4⤵
      PID:9232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21550.exe
      4⤵
      PID:14016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17825.exe
      4⤵
      PID:7832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53676.exe
    3⤵
    PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26189.exe
      4⤵
      PID:8080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
      4⤵
      PID:11092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
      4⤵
      PID:5340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31193.exe
    3⤵
    PID:9140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29776.exe
    3⤵
    PID:12564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37949.exe
    3⤵
    PID:16072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59763.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7048
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21159.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21159.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1144.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25239.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47159.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22629.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        7⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16677.exe
        8⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26511.exe
        9⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50880.exe
        9⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61564.exe
        9⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61082.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48088.exe
        8⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64576.exe
        8⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32197.exe
        7⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        8⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49213.exe
        8⤵
        
        PID:15044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        8⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
        7⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53246.exe
        6⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        7⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
        7⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        7⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        7⤵
        
        PID:16456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe
        6⤵
        
        PID:9156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18035.exe
        6⤵
        
        PID:13992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        6⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53713.exe
        6⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4834.exe
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18021.exe
        8⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38841.exe
        9⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58711.exe
        9⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34718.exe
        8⤵
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43978.exe
        8⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        8⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
        7⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18499.exe
        7⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1008.exe
        6⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3952.exe
        7⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26375.exe
        7⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63702.exe
        7⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27398.exe
        6⤵
        
        PID:10116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48769.exe
        6⤵
        
        PID:14316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33266.exe
        6⤵
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60375.exe
        5⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26189.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        6⤵
        
        PID:15220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        6⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55280.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64783.exe
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53355.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
        6⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36905.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-252.exe
        8⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49318.exe
        8⤵
        
        PID:13500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6909.exe
        8⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42991.exe
        7⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21226.exe
        7⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17295.exe
        7⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40749.exe
        6⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47673.exe
        7⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe
        7⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        7⤵
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        6⤵
        
        PID:11808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
        6⤵
        
        PID:15860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42555.exe
        5⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22105.exe
        6⤵
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        6⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19665.exe
        6⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8193.exe
        6⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe
        5⤵
        
        PID:8792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
        5⤵
        
        PID:11472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49856.exe
        5⤵
        
        PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34972.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1252
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 488
        5⤵
        Program crash
        
        PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8653.exe
      4⤵
      PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29417.exe
        6⤵
        
        PID:7856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        6⤵
        
        PID:13908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
        6⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38907.exe
        5⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27256.exe
        5⤵
        
        PID:13884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55535.exe
        5⤵
        
        PID:16808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42723.exe
      4⤵
      PID:7912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35035.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
      4⤵
      PID:14552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4681.exe
      4⤵
      PID:16876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32015.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26931.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37787.exe
        6⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22105.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        8⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35207.exe
        8⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        8⤵
        
        PID:16448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12850.exe
        7⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47190.exe
        7⤵
        
        PID:12728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1964.exe
        7⤵
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59276.exe
        6⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19967.exe
        7⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        7⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        7⤵
        
        PID:16352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        7⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
        6⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28716.exe
        6⤵
        
        PID:12768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65363.exe
        6⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9753.exe
        5⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        7⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52333.exe
        8⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30215.exe
        8⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        8⤵
        
        PID:15388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        7⤵
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14594.exe
        7⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        7⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27127.exe
        6⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19752.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35042.exe
        6⤵
        
        PID:14548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        6⤵
        
        PID:16648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7474.exe
        5⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65275.exe
        6⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
        6⤵
        
        PID:11056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41456.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        6⤵
        
        PID:16468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56475.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20775.exe
        5⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
        5⤵
        
        PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4517.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31565.exe
        5⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46469.exe
        6⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17829.exe
        7⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48996.exe
        7⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16732.exe
        7⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
        7⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46370.exe
        6⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22850.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-217.exe
        6⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41761.exe
        5⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19967.exe
        6⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        6⤵
        
        PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15336.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
        5⤵
        
        PID:13308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        5⤵
        
        PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17074.exe
      4⤵
      PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27803.exe
        5⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        6⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        6⤵
        
        PID:15800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3199.exe
        5⤵
        
        PID:8280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57085.exe
        5⤵
        
        PID:11764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
        5⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        5⤵
        
        PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44066.exe
      4⤵
      PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        5⤵
        
        PID:10324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        5⤵
        
        PID:16520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57305.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3515.exe
      4⤵
      PID:12660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64815.exe
      4⤵
      PID:16012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52729.exe
      4⤵
      PID:1928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43167.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59001.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30963.exe
        5⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32821.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe
        7⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54616.exe
        7⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
        7⤵
        
        PID:13276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        6⤵
        
        PID:9708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60915.exe
        6⤵
        
        PID:13408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe
        6⤵
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44834.exe
        5⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        6⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
        6⤵
        
        PID:16420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31620.exe
        5⤵
        
        PID:10476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61108.exe
        5⤵
        
        PID:15252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        5⤵
        
        PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34771.exe
      4⤵
      PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19967.exe
        5⤵
        
        PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16820.exe
        5⤵
        
        PID:12424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24529.exe
        5⤵
        
        PID:16284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
      4⤵
      PID:7520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28716.exe
      4⤵
      PID:12760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
      4⤵
      PID:4532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42193.exe
      4⤵
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40387.exe
        5⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
        6⤵
        
        PID:15036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
        6⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        5⤵
        
        PID:11236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39112.exe
        5⤵
        
        PID:15984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62975.exe
      4⤵
      PID:7744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
      4⤵
      PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
      4⤵
      PID:16292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30330.exe
    3⤵
    PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39619.exe
      4⤵
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8394.exe
        5⤵
        
        PID:10632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
        5⤵
        
        PID:14464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        5⤵
        
        PID:16428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
      4⤵
      PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
      4⤵
      PID:16608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19389.exe
    3⤵
    PID:7976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46071.exe
    3⤵
    PID:11276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42132.exe
    3⤵
    PID:15260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23658.exe
    3⤵
    PID:16764
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57043.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57043.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60049.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8596.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2198.exe
        8⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49318.exe
        8⤵
        
        PID:13508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32435.exe
        8⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe
        7⤵
        
        PID:10896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36412.exe
        7⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64576.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35312.exe
        6⤵
        
        PID:16264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
        6⤵
        
        PID:16280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16105.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22105.exe
        6⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60362.exe
        6⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16934.exe
        5⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
        5⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10232.exe
        5⤵
        
        PID:15772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe
        5⤵
        
        PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11123.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        6⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37009.exe
        7⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49318.exe
        7⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
        7⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42991.exe
        6⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21226.exe
        6⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16858.exe
        6⤵
        
        PID:428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        5⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        5⤵
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
        5⤵
        
        PID:16036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13312.exe
      4⤵
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34117.exe
        5⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12544.exe
        5⤵
        
        PID:12896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        5⤵
        
        PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
      4⤵
      PID:8668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64783.exe
      4⤵
      PID:11140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
      4⤵
      PID:448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43822.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59001.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        5⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48773.exe
        6⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60361.exe
        7⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        7⤵
        
        PID:10644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
        7⤵
        
        PID:16032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64206.exe
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
        6⤵
        
        PID:13792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe
        6⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
        5⤵
        
        PID:744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        5⤵
        
        PID:10964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        5⤵
        
        PID:14544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe
        5⤵
        
        PID:16544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61030.exe
      4⤵
      PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32219.exe
        5⤵
        
        PID:8004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        5⤵
        
        PID:8360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26667.exe
        5⤵
        
        PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11096.exe
      4⤵
      PID:8648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
      4⤵
      PID:16196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
      4⤵
      PID:9644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51501.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6650.exe
      4⤵
      PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4834.exe
        5⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22105.exe
        6⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
        6⤵
        
        PID:10580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        6⤵
        
        PID:16328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        6⤵
        
        PID:16556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        5⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        5⤵
        
        PID:16108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51658.exe
      4⤵
      PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2992.exe
        5⤵
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        5⤵
        
        PID:12312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
        5⤵
        
        PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24656.exe
      4⤵
      PID:8912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40138.exe
      4⤵
      PID:13628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe
      4⤵
      PID:4004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11009.exe
    3⤵
    PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26189.exe
      4⤵
      PID:8020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
      4⤵
      PID:10320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
      4⤵
      PID:15156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38301.exe
      4⤵
      PID:1232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14134.exe
    3⤵
    PID:8236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
      4⤵
      PID:13320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe
      4⤵
      PID:12976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37749.exe
    3⤵
    PID:11740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
    3⤵
    PID:15764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4681.exe
    3⤵
    PID:16636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55700.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55700.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28877.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47325.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        5⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4040.exe
        6⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2006.exe
        7⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14123.exe
        7⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64943.exe
        7⤵
        
        PID:15876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36577.exe
        6⤵
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29010.exe
        6⤵
        
        PID:14272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58467.exe
        6⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33078.exe
        5⤵
        
        PID:8440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
        5⤵
        
        PID:12012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56808.exe
        5⤵
        
        PID:10684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38855.exe
      4⤵
      PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53023.exe
        5⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8394.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8259.exe
        6⤵
        
        PID:14420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        6⤵
        
        PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34718.exe
        5⤵
        
        PID:11104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52194.exe
        5⤵
        
        PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48045.exe
      4⤵
      PID:8916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
      4⤵
      PID:10736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
      4⤵
      PID:3296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2763.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47299.exe
      4⤵
      PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        5⤵
        
        PID:10348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        5⤵
        
        PID:16312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        5⤵
        
        PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32965.exe
      4⤵
      PID:7872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe
      4⤵
      PID:10420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8015.exe
      4⤵
      PID:15096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
      4⤵
      PID:13296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
    3⤵
    PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27943.exe
      4⤵
      PID:7292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
      4⤵
      PID:11048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6645.exe
      4⤵
      PID:15824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
      4⤵
      PID:5892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2187.exe
    3⤵
    PID:8348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15390.exe
    3⤵
    PID:11812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59234.exe
    3⤵
    PID:15732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
    3⤵
    PID:16612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30989.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
      4⤵
      PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47185.exe
        5⤵
        
        PID:7500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
        5⤵
        
        PID:10548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
        5⤵
        
        PID:15240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        5⤵
        
        PID:16672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32965.exe
      4⤵
      PID:7880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
      4⤵
      PID:9164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41727.exe
      4⤵
      PID:15792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49026.exe
      4⤵
      PID:1648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
    3⤵
    PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
      4⤵
      PID:7276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47673.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe
        5⤵
        
        PID:14700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        5⤵
        
        PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
      4⤵
      PID:10592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49789.exe
      4⤵
      PID:15316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
      4⤵
      PID:16620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61859.exe
    3⤵
    PID:8340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40200.exe
    3⤵
    PID:12228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63517.exe
    3⤵
    PID:15836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39742.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15637.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15637.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56043.exe
    3⤵
    PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63547.exe
      4⤵
      PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20097.exe
        5⤵
        
        PID:8156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        5⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25027.exe
        5⤵
        
        PID:15584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1383.exe
      4⤵
      PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38.exe
      4⤵
      PID:13852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34565.exe
      4⤵
      PID:5260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44834.exe
    3⤵
    PID:7204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28332.exe
    3⤵
    PID:12064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
    3⤵
    PID:15380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35931.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35931.exe
  2⤵
  PID:6432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17829.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
    3⤵
    PID:8736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
    3⤵
    PID:16360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
    3⤵
    PID:6872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9662.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9662.exe
  2⤵
  PID:9148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59251.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59251.exe
  2⤵
  PID:12712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
  2⤵
  PID:15908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1712 -ip 1712
1⤵
PID:5252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1252 -ip 1252
1⤵
PID:5596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4336 -ip 4336
1⤵
PID:5688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4528 -ip 4528
1⤵
PID:5232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5836 -ip 5836
1⤵
PID:8512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 9028 -ip 9028
1⤵
PID:15600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 9028 -ip 9028
1⤵
PID:16132

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 916 -ip 916
1⤵
PID:16596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1144.exe

Filesize
468KB

MD5
94891c028ebac0fd455ed17eb33e8752

SHA1
d35ef6d4e17b70036fb74794a137b3f8c77c11db

SHA256
1dafdd4b45f4652193f071c69e96380f8dc7f7ebca82252e8f88fe2e803e6ab2

SHA512
e1082c6006d011bc7db29867bb27aa8ff6b7137b3c8e0da4c455fe15fb9471e9a1d373960d4e70e217962526a804294a4b11a66348b3a440139ba87ed161509f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe

Filesize
468KB

MD5
d62926a2e14a70f308a2693a0d02e0c4

SHA1
0d4ebef4abf3e1948dd17d300642f667c06bac0a

SHA256
1dff4017c4b6e2a2076c154cb30a360420bbd6131ebc09cae33d9822b4533620

SHA512
08f08b4c524764ecfda36ec89afebeebe5c10140f5c02db829037f2753018368844c0aded06dd3df2cc2b38d9dd1751c22334efda5ae6c9d861404f3feeb299a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe

Filesize
468KB

MD5
e516711ef8e665f01a6899de00d7e1d9

SHA1
4b13ed4800c705904c56a5591ce6feaf779d997e

SHA256
3fc77f336251fc2cac71aad073d353ce1d6658480bc7eac3becd700cb098fab0

SHA512
cad0a8709ff8f84bc4d93aa797bbb57c3b87487eaa10894fb5ca4779c2d6eaa46183295ea0d951c65715bf963f247863f37b509eed2bbb9bb6b124045ee7584a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20517.exe

Filesize
468KB

MD5
cc3cb56e5c9122783a18dcac2e31b243

SHA1
17ea956b3700fbd1289f7abab8e51359b8395b01

SHA256
184c0bc641f6befcef81d181e6fdbad202e7e329d3369a7c44caf2269a5b2046

SHA512
82b8f616783223a7de48e22719059ff7bd5c7828e90a1bffa54bc42275206efffb86f87111da2a54d5310fe26b60a0aa780720778d4d0814757a0a40f6daab03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21159.exe

Filesize
468KB

MD5
b36839ba550d6fde39161a926b647239

SHA1
30f93d0ada92889749374b29a94afaac244cb441

SHA256
d7c102a8a82adff789b171c7c802e0ec36d89bca735107639fbc22951a26a420

SHA512
7bf17a7fb8a32ce1252adf1907409299ecf4b74fa2cb6f0d9949d571eb87bce4f17d06c72397da65d1b68793f340c3373f10d5f43049f3ac0447051dded9e25e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21455.exe

Filesize
468KB

MD5
0618a36660d6abea9d9d3e6dbad2b360

SHA1
591f3b18e23ef4b0d04602669b3aef0e6b8ac817

SHA256
51f4588b8a98b4f76cd5f915f45f2e59eaa96fcf30f54ce38cbd11b6b67da199

SHA512
043e000388fc8a716c4ceccb72e042680c64acce03173678eb1255bbe4d0da7fc8bfbd2cf63885ac1e719bbb71ac06e081b670db8c0559602a5d4e0a24d2fc58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe

Filesize
468KB

MD5
5933cae880d2bd32ae8af7e68442510a

SHA1
591e4fb31892ca9495c06165f6cb62b75e1118cd

SHA256
549b42abec354bb9a190ad636b9b5682831f5d8cf6c7c9020b0cfd7ba3a99f8c

SHA512
8343c8ca585c4127a9c6078baf9951a05c4b147f7b84d97c6fcd4c8a62324e04250d88013bcbf751b0f6db3a8e9e1cd28d654dbd7b531a7d5bbc74b4f660cd82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25239.exe

Filesize
468KB

MD5
fd93dbe35e29a38e1e0c4a15b1d333ad

SHA1
ea26f3e5ccf0dda82e5a33ff94ee4e2d3bae57c7

SHA256
694e48970fd21fa7eb7b494e504ab0671c57ed06ab2f09c7a3cb7aec6581fbae

SHA512
9e5a55ba2f1bb7f5ae0958ea79be8e23e5fd5ee1ef66f60af04b48b9e098b0c94d92bafc9d71d529f4f35c7821dfbe184dd26de832f326d93061a69f22d383d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe

Filesize
468KB

MD5
69701565f0febc3f87fe54c5cc762c79

SHA1
5ed2c1e677e668f79655abf0b54620335e533423

SHA256
17d3dbdc0478423a4e5eba7a92fce4927b71865dcb9d039ddb309ddc65da79af

SHA512
348cf669089a5edb7fceafaa4c0ce63dccded81e580c0433316f1eac201fe35bd1642c563faff27cecf1ceeecc7786529480e4a78bc61424b942b3f0fb373088

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26931.exe

Filesize
468KB

MD5
fa5a1f8cea343dcbc425587298766533

SHA1
e412caba12c5d9975d6e7d604679358353948955

SHA256
3c47ec65e2702b0e5ab10cb264c25706c0e871c3aed5b29dfbfaf3ed5abf7c7a

SHA512
9df9b8081fde382751b4cf7e6868e702b85d760c962bb3e6264dbd7b0d2bd20dae6ec847f88016dfe109b3f8bae4eb40aa5cb7c0612c5a85996774e92e95c2a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28877.exe

Filesize
468KB

MD5
622a4c510d2226f8f729bc4e1f4d804c

SHA1
a139183f0324b86edd290cbea474a0ddf263af91

SHA256
ba9cfa153489aa670a3e218b07980b407382d32b10c7ed8189a32fd1c2f98d21

SHA512
02187047c63e0b35064489841d00b5698ce73e2fe02cdbf797c8cda743d984b0cee52f2efbc2aa990af38f4cd079d90fbc5d6851100e7a2b4f8196ad162423c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29069.exe

Filesize
468KB

MD5
ff009c86989149d9a0266f61b4fe50bc

SHA1
ec0abdc8ca15db101b7ee7b4a2ff9ad002c60b0d

SHA256
f8f7919d31265babe1333d7c375a934596f90d7cb68ccb5d59354284ecff3c6b

SHA512
f4d64afca237cbb40db215a102eaefb159a8901176581aafc9457e77347f267d408ddabc2411724c94a4b473c872eaafdf6166a1ce25bf2131919f339c2cc7dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe

Filesize
468KB

MD5
4597e346d0cef8a5d84b384295eafda9

SHA1
abefad95c7dcb90dbd1fb99f38584a0f50214982

SHA256
dcc2e1c1f82f778a19c182e0ef94917248ecb06f18c97264ef0c1b4cbf1f85a6

SHA512
111cc693709ba63730701128a8b1942a61f8689ba0b1225d90e066bff6a439742da0e1787863d105eb89fa11dd40a25d2ea4ae30ebfe6cd03559eb563177fbb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32015.exe

Filesize
468KB

MD5
56e8e064ab7a25ccec4c201a01e5961c

SHA1
6a8446ae8941220a7156f371f46a5be7023a9598

SHA256
8456a8d46942b40ec32f33cea6e5c8fee438a45299da755a857ccbc2d1778281

SHA512
d017b816b34b2645c80f538cfef93d3672a8499c4a5b14e48602d86242cf528f65416bcdf0ac0ac4ba2c8eb9bd14c58ff8c01603723c134ae9b86519dea7efed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe

Filesize
468KB

MD5
8fe95b5b04c5472984930b291b3e7df4

SHA1
b47001537162bc5ad9b89af94755a5b43443cd84

SHA256
39c773d7f68d48488275f8a7a6738a67b559f9b75d0dbef76849c0ee8abddb9e

SHA512
0f7a32b2d78be41d91945cc7f31b5bcb913e2821edad24a737da79c6dc119b85d3c32e63fe0ce3e04ec96b87fb74b1b5641781d7e7680bfedb74030e58907816

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe

Filesize
468KB

MD5
04b34c3cd798015313e334cf7bc9300a

SHA1
19e892b95fdd20fdd3894adf03db27be3bc7e823

SHA256
021e269733178aaac178201f6f4c88427db6bc2bcb04556ef1f6091f1edf566d

SHA512
4784aea3a52f959c953b1744c5e20403dd0ac915aa3a4b98e44046da4cd756d02cdc83806b3a0504e142d5323ca11adeb3429159a917f292cd445b7e7790b2b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42691.exe

Filesize
468KB

MD5
5946c6ef2817e926da7d33e2eaf9006e

SHA1
47eeabb1a9fa2ff66f4069ca12383da42ec2fb28

SHA256
ffd471dbf795ea12a3c9cf08ff3c7900c456bb79ce8a5cfb485184c775c54fef

SHA512
805875ae7d819c48973251463adb4e236cd2ee1f11019bf702b1f97da7db1ed5976b0fb24b95df3b4b5f7dd1a6f86f13dcca3d1f750e96835ddde9ca8b537238

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43167.exe

Filesize
468KB

MD5
da546d54604863f0a231b5bda0691a3b

SHA1
9f651b1880e62d91704a964f839735278aa6dc61

SHA256
6053ee59996c9471832ddc4d55edf71524c9774bb40a6d38fa4fdfa299359c39

SHA512
e00d901f6af82651a7132a01d078681f63926c0b5cec4b2ec189d6e2b86b37e0b4592bd21dfc062e535c6e121007e173035321505d84ae35ec8e85e0e1923d0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43822.exe

Filesize
468KB

MD5
8edd42422d1f37f36a3d046e7147adec

SHA1
38ec30e2aee5651b942d7516c89da44e7f4f269e

SHA256
b5e95c1f619f31f74a3688e46f33a510409f7a3e2b93e1269aa1c605642a1b18

SHA512
be217eac93a8b10f3951ac00b85de9237fab45c709ba2c20b98b00edd2a2a4e123a2f86915d55f3f25e1f8fc0decbf60c873be8f50a3908f2d03bf0587df964d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45109.exe

Filesize
468KB

MD5
6defa8efee6ba8aa061a2ee0b5449c42

SHA1
e571acb3118c281f2ad78b17539713a613dcca9a

SHA256
c95341a47a1057e33898c57e5adf1b556ab58a4b9d0b22abaf087f60aec32c1f

SHA512
5a749ecf0d748e64398d29cdab1f28991957c861e6f032ecba5f886a092e7e2f88c228554948e48e9d0c7f92aa4d7444c683cc385b50571ee07bf2d56d3a5439

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45751.exe

Filesize
468KB

MD5
86802883f3be28296b969a3a896d674b

SHA1
dfe5264e1f311b01adc1183df3771bb67d14a746

SHA256
7890771f0ca747b8e4577164461f66dd4b5d9b2718c60fbc08f18237988774c0

SHA512
bbf85caac4a65cbb118b8ec0342f65c0a70a33e3fefc8430da594d299ca47736469f986f42966f90b7e934b9bffa191a100a324157332925d2e78f7e6975c20e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46816.exe

Filesize
468KB

MD5
b744293c89cef32501ecec1d7853213c

SHA1
d2fdc46480ab066e7a4756f5f737f0edd799de77

SHA256
dd6ce8d0832953b9022d11291622b30afbac93cc92eccd6dd8c3ad365173a25d

SHA512
1248d6d6ae84ba65121fbed78ff1f40518f643628e5b77ed732e003f7ae9049e112dab9badaa0fe010e4e93241984757f20d3c19fde068a0faa4d90e3b0e1110

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47159.exe

Filesize
468KB

MD5
529ad56c9a7400561cf913fa0b7fb25f

SHA1
78a1be0a44b833ad290189eaad42a10ea455651d

SHA256
9ccebe2a768d01c42e2eebe300f69807d8d3b0520320d5b24241ef55cdb825cb

SHA512
deeea196a5d9a68ed1a9aa27ac7342a38c3cc6950288d1756076c7ecdcfff12d90273eb1958f0e76f9ba0bc643323cbdd4f1537238d0259503be22c55f4c93a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49297.exe

Filesize
468KB

MD5
a2e1938644a6940bf255b4659b654d7a

SHA1
d4cb54c0ef103bfc97310fa0270f4b1ed03961a0

SHA256
c7fc8c5d02f25ca19733a73211b2f48e1aa7f98de4133b3b117e7f427a52a0ec

SHA512
fb3522196d154d118970b349ed2424af14607e6bf3a142a18c04dde3d12be3e1b14e3d830ccc422c1663bceacad38c081b1a669eb6ff82c0ebe7938599fa58c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49935.exe

Filesize
468KB

MD5
8f4c506cfaa8b66d89907252b6b9255b

SHA1
771d39661bd8003dd5d9cf8b885343a455ce03b3

SHA256
9fa3b0b9f898732fd5c621e1f32b633011102cc1f9489b3223fd7151f71000f2

SHA512
6dcf3da73d752cc45c6569d62682e264efc13cc0f77c2cea764316b1b49c1980367f18690e2d63379d936d3223486af7800ad416473831ddeadb08e495073d4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe

Filesize
468KB

MD5
9cf58a222d5c18e3f26fbb1e3d91cadf

SHA1
51b4ad812ee22f70fecf239dcb026bea9890be67

SHA256
15fb99b3e8e2361c1d8fa0a18c5dc019f83ddf7806d50d8195ab5a9478878853

SHA512
263ef7315c4453b1b09e86c7c5da61f73b36e83544b12b87f90b3a10478e96774e803891c558afb52b2c49340fd267fc7def26a19b70511b7b098f9594d558cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55700.exe

Filesize
468KB

MD5
3ba133752ebade30aa384e9934fc5d1c

SHA1
d7cd37606cf13b7c2a41b9bf631488689457950f

SHA256
02710be3409cdd910bb4b83062429a66bdcc417d30174e9dd4aaf7b3f6f87657

SHA512
d392b94405b8fcbed2c3130d58cd76b4d503a7c52992d391ed1225ce5783cf5aeb2e57667b66f275c63661da1e173b8fd4b118cf6f66f6361e2b9dff0744051b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56074.exe

Filesize
468KB

MD5
c69e8438b7a78b1544c414513a708691

SHA1
a19bd8043e6e5eacc582d15018cb858d87cb1d01

SHA256
485b59c18b409fb2f2e808a40b9ff92737df8dfe06b552ca6c41e3378e7650a8

SHA512
9aea3a3174bac50fb07b0db56181c03ebd5acca28a905f0e55c3220371ce303578169f4fde6bb31f2be2abdf2fc82c3d532be5fcf65afcca6eb1abbcb22b73af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57043.exe

Filesize
468KB

MD5
bebb219a1316bd5aa1abfb8dbd110ba6

SHA1
e16cf6fb7e49ada5ecb681e9436324df0eaa35b6

SHA256
6873ec52cd6fd645f7223bb007a241d975d5b308c7fb3e550d843f7b0db97cf4

SHA512
7b260b10b848fd70d51f8cff34051f15f11946a9bfbc6030e9a28b232ed8f6befeb4da16160e6ca723346e8b14bee4ca93acb9c0594f1196be903118fb1b022a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60049.exe

Filesize
468KB

MD5
8e76cf222232fd6876254a4a2036b631

SHA1
f498cacc58656fc3493801e9f6daa6b50025fa49

SHA256
84276202cba08db29a612de55ad7da02d2beae140af5c9fd8daf9b23ba29d7b5

SHA512
df7f0dc1b4a88dd5d5bea10cb88e0d4cb842f817c30365c7ee7a8e5fbdedbafbdcab6db62991c1612257efe85a20eb8459a48fde5adfa48157b666d9ecc9206b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe

Filesize
468KB

MD5
eb0acaeb5e8556b36252c58aaa9edf72

SHA1
3d296dde5f607623a3ac4656cbc8d15f1e7e516f

SHA256
5a82c3dae366c88ddb6c8e794067c5d8aeb90a2764e1937b1f3ed9298ea67390

SHA512
db251591b1dca47dfef632ef7be2804164f821326d030bb01b6ffb18e976a882c4925ba6caebace7a625196879bb3000c1bf181a66f2617543465e3191c38859

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6410.exe

Filesize
468KB

MD5
b090fd525b3714db4d87f91c8f9dba81

SHA1
88782b667647bf8b2859c473a3f6fd168b14b44b

SHA256
32b963179daa56bc6831c8adeb786cb0d996aa002acd97eff9be082d1ed7fcc7

SHA512
9dde6a660586178a54cd17f022526328bed58874713a64c0cc52bbb32ffbd19dcbf60b6b428d448e15e9758e232605bd350f802476d2d5158ee1ae3032fcaf78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe

Filesize
468KB

MD5
d1769e14e50a78419abfb822c790d04b

SHA1
899712ab69b2f8d2d06c0881c4997146c6f4e114

SHA256
82b61d26cf6e0b77e2c52ddca31c319742ef6741a4156df43a25fd8f4460278f

SHA512
38fbf4bacd94102445595b963f851848647932514228f829e7defa3fb11f4402559aa0ee74d5ddc40361ab23b3445394837a584c5086ab6c108219b75097ee07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7574.exe

Filesize
468KB

MD5
8f8dec66fc9475eb3738d77d9b809ebd

SHA1
6e422b71fb834128506c3d406c789102b4951cd6

SHA256
5aba2815730bd0464f08fe418798ed0f4a66f8873b663a9c19e3dc97b77358df

SHA512
55d6b2d849b01157370d4669aca5b87b3235cd82181b6ce3349331eb642944ff80adba2e6028e95439ed0a169836c1da217c08c7aeb7bf4a0877135b34d64e8b

Download Submit
memory/216-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/792-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/884-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/916-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1040-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1056-203-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1064-211-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1128-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1188-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1196-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1252-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1264-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1356-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1412-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1520-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1560-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1592-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1644-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1668-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1696-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1776-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1820-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1956-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2024-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2060-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2136-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2368-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2432-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2456-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2516-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2568-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2880-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3000-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3012-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3052-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3092-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3132-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3160-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3180-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3192-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3232-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3260-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3364-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3384-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3572-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3588-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3632-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3640-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3696-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3720-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3948-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3988-155-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4012-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4044-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4160-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4224-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4232-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4332-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4336-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4408-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4416-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4484-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4504-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4528-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4568-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4712-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4772-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4896-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4948-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4964-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5036-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5072-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5268-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5300-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5352-493-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5388-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5396-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5420-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5712-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5732-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5784-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5800-512-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5820-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5844-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5928-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6032-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6048-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6056-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6096-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15220-2583-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15752-2549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15864-2550-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16072-2686-0x00000000777C0000-0x00000000777CA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads