1f69baddb71e5714fdb54a87b706fc2f237dcd5c7c096ba67d608a73c2755032

Analysis

max time kernel
119s
max time network
91s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04c1b7f9e6620c28953f4e68b7fbc8e0N.exe
Size

468KB
MD5

04c1b7f9e6620c28953f4e68b7fbc8e0
SHA1

eb8f31c267e678e216390584fc8864e4f4478523
SHA256

1f69baddb71e5714fdb54a87b706fc2f237dcd5c7c096ba67d608a73c2755032
SHA512

a44696c361c716ce295df7b9ff5668676f417de7e303dd065b1766dab0ba8fc17bf4d10e967a4fdeac77f591ece29661b4edfebb30d4da4041b6f2a4451a0e96
SSDEEP

3072:Xq0bogCdj0GG2bY9Pzh1ff8l5CyAXipCnmHevVpkY8i3WS//k5la:Xq8ohjG2+PN1ffBqo8Y8QB//k

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1368	Unicorn-33145.exe
3844	Unicorn-63845.exe
4604	Unicorn-35811.exe
840	Unicorn-22341.exe
3608	Unicorn-14172.exe
3276	Unicorn-65411.exe
4204	Unicorn-51676.exe
4796	Unicorn-24261.exe
3160	Unicorn-53596.exe
4008	Unicorn-49512.exe
3452	Unicorn-12008.exe
1328	Unicorn-61209.exe
4420	Unicorn-48500.exe
2816	Unicorn-48765.exe
4880	Unicorn-34466.exe
2840	Unicorn-42865.exe
3256	Unicorn-6663.exe
2344	Unicorn-27489.exe
1196	Unicorn-44380.exe
400	Unicorn-10768.exe
1748	Unicorn-64053.exe
4620	Unicorn-27659.exe
3612	Unicorn-41395.exe
3248	Unicorn-31189.exe
412	Unicorn-18174.exe
3540	Unicorn-43441.exe
1128	Unicorn-10066.exe
4100	Unicorn-16197.exe
2292	Unicorn-49616.exe
2120	Unicorn-8028.exe
1456	Unicorn-3679.exe
3756	Unicorn-28641.exe
4148	Unicorn-24557.exe
3100	Unicorn-607.exe
2672	Unicorn-11602.exe
4916	Unicorn-25517.exe
4048	Unicorn-54660.exe
60	Unicorn-62273.exe
1800	Unicorn-47975.exe
2156	Unicorn-21241.exe
4608	Unicorn-50981.exe
2560	Unicorn-31115.exe
4136	Unicorn-56772.exe
4544	Unicorn-55833.exe
2932	Unicorn-31137.exe
1864	Unicorn-31137.exe
4112	Unicorn-7187.exe
4760	Unicorn-18693.exe
908	Unicorn-6440.exe
1356	Unicorn-49511.exe
2704	Unicorn-55376.exe
4900	Unicorn-17731.exe
4460	Unicorn-34266.exe
1788	Unicorn-43197.exe
3916	Unicorn-61033.exe
2336	Unicorn-52865.exe
4808	Unicorn-22038.exe
5104	Unicorn-8303.exe
5080	Unicorn-3472.exe
4968	Unicorn-12195.exe
1020	Unicorn-3280.exe
1400	Unicorn-64733.exe
3196	Unicorn-31796.exe
2804	Unicorn-36699.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
15800	15732	WerFault.exe	740
15764	15128	WerFault.exe	706

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1047.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40231.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15572	dwm.exe
Token: SeChangeNotifyPrivilege	15572	dwm.exe
Token: 33	15572	dwm.exe
Token: SeIncBasePriorityPrivilege	15572	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4588	04c1b7f9e6620c28953f4e68b7fbc8e0N.exe
1368	Unicorn-33145.exe
4604	Unicorn-35811.exe
3844	Unicorn-63845.exe
3608	Unicorn-14172.exe
840	Unicorn-22341.exe
3276	Unicorn-65411.exe
4204	Unicorn-51676.exe
4796	Unicorn-24261.exe
1328	Unicorn-61209.exe
3160	Unicorn-53596.exe
3452	Unicorn-12008.exe
4008	Unicorn-49512.exe
4880	Unicorn-34466.exe
4420	Unicorn-48500.exe
2816	Unicorn-48765.exe
2840	Unicorn-42865.exe
3256	Unicorn-6663.exe
2344	Unicorn-27489.exe
1196	Unicorn-44380.exe
400	Unicorn-10768.exe
4620	Unicorn-27659.exe
1748	Unicorn-64053.exe
3248	Unicorn-31189.exe
3612	Unicorn-41395.exe
412	Unicorn-18174.exe
1456	Unicorn-3679.exe
2120	Unicorn-8028.exe
4100	Unicorn-16197.exe
1128	Unicorn-10066.exe
2292	Unicorn-49616.exe
3540	Unicorn-43441.exe
3756	Unicorn-28641.exe
2672	Unicorn-11602.exe
4148	Unicorn-24557.exe
3100	Unicorn-607.exe
4916	Unicorn-25517.exe
4048	Unicorn-54660.exe
60	Unicorn-62273.exe
1800	Unicorn-47975.exe
2156	Unicorn-21241.exe
4608	Unicorn-50981.exe
2560	Unicorn-31115.exe
4136	Unicorn-56772.exe
4544	Unicorn-55833.exe
4760	Unicorn-18693.exe
1864	Unicorn-31137.exe
4112	Unicorn-7187.exe
2932	Unicorn-31137.exe
908	Unicorn-6440.exe
4900	Unicorn-17731.exe
2704	Unicorn-55376.exe
1356	Unicorn-49511.exe
3916	Unicorn-61033.exe
4460	Unicorn-34266.exe
1788	Unicorn-43197.exe
2336	Unicorn-52865.exe
4808	Unicorn-22038.exe
4968	Unicorn-12195.exe
5080	Unicorn-3472.exe
2804	Unicorn-36699.exe
2232	Unicorn-7919.exe
3092	Unicorn-21654.exe
2116	Unicorn-36699.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 1368	4588	04c1b7f9e6620c28953f4e68b7fbc8e0N.exe	89
PID 4588 wrote to memory of 1368	4588	04c1b7f9e6620c28953f4e68b7fbc8e0N.exe	89
PID 4588 wrote to memory of 1368	4588	04c1b7f9e6620c28953f4e68b7fbc8e0N.exe	89
PID 1368 wrote to memory of 3844	1368	Unicorn-33145.exe	92
PID 1368 wrote to memory of 3844	1368	Unicorn-33145.exe	92
PID 1368 wrote to memory of 3844	1368	Unicorn-33145.exe	92
PID 4588 wrote to memory of 4604	4588	04c1b7f9e6620c28953f4e68b7fbc8e0N.exe	93
PID 4588 wrote to memory of 4604	4588	04c1b7f9e6620c28953f4e68b7fbc8e0N.exe	93
PID 4588 wrote to memory of 4604	4588	04c1b7f9e6620c28953f4e68b7fbc8e0N.exe	93
PID 4604 wrote to memory of 840	4604	Unicorn-35811.exe	96
PID 4604 wrote to memory of 840	4604	Unicorn-35811.exe	96
PID 4604 wrote to memory of 840	4604	Unicorn-35811.exe	96
PID 3844 wrote to memory of 3608	3844	Unicorn-63845.exe	97
PID 3844 wrote to memory of 3608	3844	Unicorn-63845.exe	97
PID 3844 wrote to memory of 3608	3844	Unicorn-63845.exe	97
PID 4588 wrote to memory of 3276	4588	04c1b7f9e6620c28953f4e68b7fbc8e0N.exe	98
PID 4588 wrote to memory of 3276	4588	04c1b7f9e6620c28953f4e68b7fbc8e0N.exe	98
PID 4588 wrote to memory of 3276	4588	04c1b7f9e6620c28953f4e68b7fbc8e0N.exe	98
PID 1368 wrote to memory of 4204	1368	Unicorn-33145.exe	99
PID 1368 wrote to memory of 4204	1368	Unicorn-33145.exe	99
PID 1368 wrote to memory of 4204	1368	Unicorn-33145.exe	99
PID 840 wrote to memory of 4796	840	Unicorn-22341.exe	100
PID 840 wrote to memory of 4796	840	Unicorn-22341.exe	100
PID 840 wrote to memory of 4796	840	Unicorn-22341.exe	100
PID 3844 wrote to memory of 3160	3844	Unicorn-63845.exe	102
PID 3844 wrote to memory of 3160	3844	Unicorn-63845.exe	102
PID 3844 wrote to memory of 3160	3844	Unicorn-63845.exe	102
PID 4604 wrote to memory of 4008	4604	Unicorn-35811.exe	103
PID 4604 wrote to memory of 4008	4604	Unicorn-35811.exe	103
PID 4604 wrote to memory of 4008	4604	Unicorn-35811.exe	103
PID 3608 wrote to memory of 3452	3608	Unicorn-14172.exe	101
PID 3608 wrote to memory of 3452	3608	Unicorn-14172.exe	101
PID 3608 wrote to memory of 3452	3608	Unicorn-14172.exe	101
PID 3276 wrote to memory of 1328	3276	Unicorn-65411.exe	104
PID 3276 wrote to memory of 1328	3276	Unicorn-65411.exe	104
PID 3276 wrote to memory of 1328	3276	Unicorn-65411.exe	104
PID 4588 wrote to memory of 4420	4588	04c1b7f9e6620c28953f4e68b7fbc8e0N.exe	105
PID 4588 wrote to memory of 4420	4588	04c1b7f9e6620c28953f4e68b7fbc8e0N.exe	105
PID 4588 wrote to memory of 4420	4588	04c1b7f9e6620c28953f4e68b7fbc8e0N.exe	105
PID 4204 wrote to memory of 2816	4204	Unicorn-51676.exe	106
PID 4204 wrote to memory of 2816	4204	Unicorn-51676.exe	106
PID 4204 wrote to memory of 2816	4204	Unicorn-51676.exe	106
PID 1368 wrote to memory of 4880	1368	Unicorn-33145.exe	107
PID 1368 wrote to memory of 4880	1368	Unicorn-33145.exe	107
PID 1368 wrote to memory of 4880	1368	Unicorn-33145.exe	107
PID 4796 wrote to memory of 2840	4796	Unicorn-24261.exe	108
PID 4796 wrote to memory of 2840	4796	Unicorn-24261.exe	108
PID 4796 wrote to memory of 2840	4796	Unicorn-24261.exe	108
PID 840 wrote to memory of 3256	840	Unicorn-22341.exe	109
PID 840 wrote to memory of 3256	840	Unicorn-22341.exe	109
PID 840 wrote to memory of 3256	840	Unicorn-22341.exe	109
PID 1328 wrote to memory of 2344	1328	Unicorn-61209.exe	110
PID 1328 wrote to memory of 2344	1328	Unicorn-61209.exe	110
PID 1328 wrote to memory of 2344	1328	Unicorn-61209.exe	110
PID 3276 wrote to memory of 1196	3276	Unicorn-65411.exe	111
PID 3276 wrote to memory of 1196	3276	Unicorn-65411.exe	111
PID 3276 wrote to memory of 1196	3276	Unicorn-65411.exe	111
PID 3160 wrote to memory of 400	3160	Unicorn-53596.exe	112
PID 3160 wrote to memory of 400	3160	Unicorn-53596.exe	112
PID 3160 wrote to memory of 400	3160	Unicorn-53596.exe	112
PID 3452 wrote to memory of 1748	3452	Unicorn-12008.exe	113
PID 3452 wrote to memory of 1748	3452	Unicorn-12008.exe	113
PID 3452 wrote to memory of 1748	3452	Unicorn-12008.exe	113
PID 3608 wrote to memory of 4620	3608	Unicorn-14172.exe	114

C:\Users\Admin\AppData\Local\Temp\04c1b7f9e6620c28953f4e68b7fbc8e0N.exe
"C:\Users\Admin\AppData\Local\Temp\04c1b7f9e6620c28953f4e68b7fbc8e0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33145.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33145.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14172.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12008.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64053.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57141.exe
        8⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32393.exe
        9⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20733.exe
        10⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        10⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6915.exe
        10⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60654.exe
        10⤵
        
        PID:15500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe
        9⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        9⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        9⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26279.exe
        8⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45045.exe
        9⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        9⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23424.exe
        9⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35766.exe
        9⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12822.exe
        8⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe
        8⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
        8⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        8⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53197.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        9⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-919.exe
        9⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37300.exe
        9⤵
        
        PID:15596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49129.exe
        9⤵
        
        PID:488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37135.exe
        8⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62616.exe
        8⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14386.exe
        8⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11810.exe
        7⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53405.exe
        8⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23835.exe
        8⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7122.exe
        8⤵
        
        PID:14680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        7⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe
        7⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30547.exe
        7⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56772.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7888.exe
        8⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        9⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
        9⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10822.exe
        9⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36877.exe
        9⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45408.exe
        8⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8598.exe
        8⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62188.exe
        8⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31302.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22195.exe
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34137.exe
        8⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64373.exe
        9⤵
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45380.exe
        9⤵
        
        PID:15428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        8⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16648.exe
        8⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
        7⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30712.exe
        7⤵
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27406.exe
        7⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29269.exe
        7⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9056.exe
        8⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58799.exe
        9⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe
        8⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4190.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65200.exe
        7⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
        7⤵
        
        PID:12588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
        6⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        7⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        7⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2515.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        6⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe
        6⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        6⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31137.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1308.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28989.exe
        8⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
        9⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        9⤵
        
        PID:13924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16423.exe
        9⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3659.exe
        8⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        8⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        8⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15178.exe
        7⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe
        7⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        7⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33331.exe
        6⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        7⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        7⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11118.exe
        7⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6599.exe
        7⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25074.exe
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63000.exe
        6⤵
        
        PID:12300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26347.exe
        6⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49511.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58677.exe
        6⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        8⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        8⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        8⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35179.exe
        7⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        7⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5987.exe
        7⤵
        
        PID:15528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23134.exe
        7⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7343.exe
        6⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
        6⤵
        
        PID:11024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16687.exe
        6⤵
        
        PID:14472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6599.exe
        6⤵
        
        PID:14780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28236.exe
        5⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
        6⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        6⤵
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44036.exe
        6⤵
        
        PID:15400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43742.exe
        6⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
        5⤵
        
        PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28287.exe
        5⤵
        
        PID:10548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        5⤵
        
        PID:15884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43652.exe
        5⤵
        
        PID:16288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53596.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10768.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32829.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21101.exe
        8⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        9⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42345.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        9⤵
        
        PID:13388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        9⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64816.exe
        8⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        8⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48044.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32357.exe
        8⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        8⤵
        
        PID:13076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
        8⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24986.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7367.exe
        7⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
        6⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
        7⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28901.exe
        8⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40363.exe
        8⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44455.exe
        8⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23895.exe
        8⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64327.exe
        7⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9034.exe
        7⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35766.exe
        7⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3066.exe
        6⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        7⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        7⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14767.exe
        7⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54204.exe
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40111.exe
        6⤵
        
        PID:13472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21048.exe
        6⤵
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6119.exe
        6⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31115.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44889.exe
        6⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25377.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        8⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56175.exe
        8⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23424.exe
        8⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        8⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        7⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        7⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5667.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25393.exe
        7⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        8⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12507.exe
        7⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        7⤵
        
        PID:15376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        7⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21566.exe
        6⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        6⤵
        
        PID:12548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26731.exe
        6⤵
        
        PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26314.exe
        5⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
        6⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55245.exe
        8⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39147.exe
        8⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        7⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40961.exe
        7⤵
        
        PID:14644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60732.exe
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
        6⤵
        
        PID:12764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40961.exe
        6⤵
        
        PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8931.exe
        5⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64069.exe
        6⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51184.exe
        6⤵
        
        PID:12620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56427.exe
        6⤵
        
        PID:16320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62880.exe
        5⤵
        
        PID:13116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8848.exe
        5⤵
        
        PID:15540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
        5⤵
        
        PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31137.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62761.exe
        6⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
        7⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61049.exe
        8⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        8⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
        8⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60452.exe
        7⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        7⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3259.exe
        6⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
        6⤵
        
        PID:11052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20771.exe
        6⤵
        
        PID:14928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24403.exe
        6⤵
        
        PID:15616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33331.exe
        5⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
        6⤵
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
        6⤵
        
        PID:10980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18990.exe
        6⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7758.exe
        6⤵
        
        PID:244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
        5⤵
        
        PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14463.exe
        5⤵
        
        PID:10900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53523.exe
        5⤵
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        5⤵
        
        PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31241.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28989.exe
        6⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
        7⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        7⤵
        
        PID:12844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48776.exe
        6⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38187.exe
        7⤵
        
        PID:15288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        6⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1903.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
        5⤵
        
        PID:8292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe
        5⤵
        
        PID:12536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40023.exe
        5⤵
        
        PID:16080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35522.exe
      4⤵
      PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
        5⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
        6⤵
        
        PID:16212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        5⤵
        
        PID:11852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50856.exe
      4⤵
      PID:8792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45353.exe
      4⤵
      PID:12168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5818.exe
      4⤵
      PID:15560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46064.exe
      4⤵
      PID:3952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51676.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48765.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16197.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61033.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31241.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4183.exe
        8⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26849.exe
        9⤵
        
        PID:16204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55956.exe
        9⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
        8⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        8⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65436.exe
        8⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36751.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2943.exe
        7⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25702.exe
        7⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50281.exe
        7⤵
        
        PID:15356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32179.exe
        6⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        7⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14899.exe
        7⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        7⤵
        
        PID:15084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38915.exe
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59772.exe
        6⤵
        
        PID:10448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4322.exe
        6⤵
        
        PID:14656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40961.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
        5⤵
        Executes dropped EXE
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24609.exe
        6⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
        7⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11583.exe
        7⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44036.exe
        7⤵
        
        PID:15408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27867.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57135.exe
        6⤵
        
        PID:12580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65224.exe
        6⤵
        
        PID:16132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
        6⤵
        
        PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19054.exe
        5⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        6⤵
        
        PID:11676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23514.exe
        6⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26856.exe
        5⤵
        
        PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47075.exe
        5⤵
        
        PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49616.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43197.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44261.exe
        6⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-208.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60452.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        7⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63975.exe
        7⤵
        
        PID:14792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        6⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1620.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46444.exe
        7⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48599.exe
        7⤵
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32108.exe
        6⤵
        
        PID:11652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe
        6⤵
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34993.exe
        6⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        6⤵
        
        PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
        5⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58257.exe
        6⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60208.exe
        6⤵
        
        PID:11412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        6⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44315.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50347.exe
        5⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52555.exe
        5⤵
        
        PID:13440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55319.exe
        5⤵
        
        PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47385.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24713.exe
        6⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60909.exe
        7⤵
        
        PID:14064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15998.exe
        6⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53252.exe
        6⤵
        
        PID:15224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64739.exe
        6⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31847.exe
        5⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        6⤵
        
        PID:13712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
        5⤵
        
        PID:11032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37108.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65436.exe
        5⤵
        
        PID:15436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe
      4⤵
      PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34137.exe
        5⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        5⤵
        
        PID:12276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16648.exe
        5⤵
        
        PID:14788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
      4⤵
      PID:8528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49475.exe
      4⤵
      PID:12748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30931.exe
      4⤵
      PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34466.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8028.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43471.exe
        5⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
        6⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48693.exe
        7⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27787.exe
        7⤵
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
        6⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        7⤵
        
        PID:16052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17435.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        6⤵
        
        PID:12728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40431.exe
        6⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16994.exe
        5⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        6⤵
        
        PID:10480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32795.exe
        6⤵
        
        PID:16220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48407.exe
        6⤵
        
        PID:380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22247.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12106.exe
        5⤵
        
        PID:14896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36699.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56129.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27209.exe
        6⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43487.exe
        6⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39219.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31833.exe
        6⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58812.exe
        5⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe
        5⤵
        
        PID:11632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25048.exe
        5⤵
        
        PID:14800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe
        5⤵
        
        PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35931.exe
      4⤵
      PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49129.exe
        5⤵
        
        PID:8120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        5⤵
        
        PID:11740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26638.exe
        5⤵
        
        PID:12984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26856.exe
      4⤵
      PID:8804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe
      4⤵
      PID:11724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41839.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3679.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38449.exe
        5⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
        6⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35895.exe
        7⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe
        7⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3667.exe
        7⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51883.exe
        6⤵
        
        PID:9988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55024.exe
        6⤵
        
        PID:12104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36714.exe
        6⤵
        
        PID:15760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23514.exe
        6⤵
        
        PID:14508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1286.exe
        5⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
        6⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48836.exe
        6⤵
        
        PID:12832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54780.exe
        5⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59771.exe
        5⤵
        
        PID:12432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49129.exe
        5⤵
        
        PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38811.exe
      4⤵
      PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16.exe
        5⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        6⤵
        
        PID:9584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        6⤵
        
        PID:14148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39455.exe
        5⤵
        
        PID:9432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        5⤵
        
        PID:13428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe
        5⤵
        
        PID:7772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45583.exe
      4⤵
      PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
        5⤵
        
        PID:8616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        5⤵
        
        PID:13944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
        5⤵
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22247.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8022.exe
      4⤵
      PID:15116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53721.exe
      4⤵
      PID:14744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45890.exe
      4⤵
      PID:16044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
      4⤵
      PID:6776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34266.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64105.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28989.exe
        5⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        6⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48836.exe
        6⤵
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
        5⤵
        
        PID:9796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        5⤵
        
        PID:12384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23134.exe
        5⤵
        
        PID:1320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11427.exe
      4⤵
      PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
        5⤵
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        5⤵
        
        PID:13856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49096.exe
        5⤵
        
        PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
      4⤵
      PID:10964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39647.exe
      4⤵
      PID:16252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63587.exe
      4⤵
      PID:448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
    3⤵
    PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe
      4⤵
      PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe
        5⤵
        
        PID:14496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        5⤵
        
        PID:632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48200.exe
      4⤵
      PID:10008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
      4⤵
      PID:13900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3674.exe
      4⤵
      PID:5968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3396.exe
    3⤵
    PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40437.exe
      4⤵
      PID:9656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
      4⤵
      PID:12776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3979.exe
      4⤵
      PID:5608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37698.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37698.exe
    3⤵
    PID:11104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47223.exe
    3⤵
    PID:15076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5935.exe
    3⤵
    PID:14784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22341.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24261.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42865.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28641.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
        8⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4183.exe
        9⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
        9⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33024.exe
        9⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32255.exe
        9⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31847.exe
        8⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56825.exe
        9⤵
        
        PID:13776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53164.exe
        9⤵
        
        PID:15484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
        8⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        8⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17351.exe
        8⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49129.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62688.exe
        7⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        8⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33579.exe
        9⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        8⤵
        
        PID:13084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10082.exe
        7⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43156.exe
        7⤵
        
        PID:12908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38890.exe
        7⤵
        
        PID:16016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12195.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48537.exe
        7⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5828.exe
        8⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52497.exe
        9⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        9⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9279.exe
        8⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        8⤵
        
        PID:13384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40431.exe
        8⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41515.exe
        7⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37571.exe
        7⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12987.exe
        7⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        7⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21986.exe
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11583.exe
        7⤵
        
        PID:10684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44036.exe
        7⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3983.exe
        7⤵
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19238.exe
        7⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26655.exe
        6⤵
        
        PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48397.exe
        6⤵
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
        7⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        8⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        8⤵
        
        PID:13068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29131.exe
        8⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51220.exe
        7⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        7⤵
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19339.exe
        7⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10302.exe
        7⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42807.exe
        6⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31567.exe
        7⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1620.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31103.exe
        8⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        7⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43934.exe
        7⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20990.exe
        6⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe
        6⤵
        
        PID:12284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe
        6⤵
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31817.exe
        6⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
        7⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
        8⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        8⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        8⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40223.exe
        7⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        7⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27218.exe
        7⤵
        
        PID:15556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
        6⤵
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25362.exe
        6⤵
        
        PID:12520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40023.exe
        6⤵
        
        PID:16044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23514.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10354.exe
        5⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
        6⤵
        
        PID:8512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        6⤵
        
        PID:10644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
        6⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        5⤵
        
        PID:9688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        5⤵
        
        PID:13160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6663.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24557.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3280.exe
        6⤵
        Executes dropped EXE
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
        7⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        8⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
        9⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        9⤵
        
        PID:13784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
        8⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10822.exe
        8⤵
        
        PID:15060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7136.exe
        8⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37135.exe
        7⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
        8⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62616.exe
        7⤵
        
        PID:13276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51142.exe
        7⤵
        
        PID:15424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5319.exe
        6⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        7⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40171.exe
        7⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44036.exe
        7⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39850.exe
        7⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53279.exe
        6⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62616.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        6⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
        6⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        7⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58945.exe
        8⤵
        
        PID:15748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33912.exe
        8⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
        7⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10822.exe
        7⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21692.exe
        7⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25179.exe
        6⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53907.exe
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
        6⤵
        
        PID:14756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33301.exe
        6⤵
        
        PID:16316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62336.exe
        6⤵
        
        PID:8952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23138.exe
        5⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34137.exe
        6⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62189.exe
        7⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        6⤵
        
        PID:440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28392.exe
        5⤵
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
        5⤵
        
        PID:12824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        5⤵
        
        PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11602.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe
        5⤵
        Executes dropped EXE
        
        PID:1400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19565.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34417.exe
        7⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
        8⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13231.exe
        8⤵
        
        PID:15128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15128 -s 472
        9⤵
        Program crash
        
        PID:15764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe
        8⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
        7⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23074.exe
        7⤵
        
        PID:14968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53405.exe
        7⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37135.exe
        6⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19547.exe
        7⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62616.exe
        6⤵
        
        PID:12648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57711.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        6⤵
        
        PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13487.exe
        5⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
        6⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        6⤵
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
        6⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6190.exe
        5⤵
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22928.exe
        5⤵
        
        PID:12848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31682.exe
        5⤵
        
        PID:7044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27520.exe
      4⤵
      PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60213.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        6⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        7⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48836.exe
        7⤵
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20507.exe
        7⤵
        
        PID:15832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17447.exe
        6⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
        7⤵
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        6⤵
        
        PID:13436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23134.exe
        6⤵
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25179.exe
        5⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-814.exe
        5⤵
        
        PID:10340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-735.exe
        5⤵
        
        PID:14812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23664.exe
        5⤵
        
        PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33130.exe
      4⤵
      PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46508.exe
        5⤵
        
        PID:9752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe
        5⤵
        
        PID:13172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51816.exe
      4⤵
      PID:9732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
      4⤵
      PID:13148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52854.exe
      4⤵
      PID:15640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49512.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31189.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55833.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40369.exe
        7⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45045.exe
        8⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        8⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40144.exe
        8⤵
        
        PID:16300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe
        7⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        7⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54868.exe
        6⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21989.exe
        7⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
        7⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31871.exe
        7⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48339.exe
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48776.exe
        6⤵
        
        PID:13464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42974.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        7⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48200.exe
        6⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62187.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35386.exe
        6⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21078.exe
        5⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe
        6⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53180.exe
        6⤵
        
        PID:15464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22247.exe
        5⤵
        
        PID:11092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12106.exe
        5⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58449.exe
        5⤵
        
        PID:7676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7187.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41115.exe
        5⤵
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5636.exe
        6⤵
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
        6⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10822.exe
        6⤵
        
        PID:15044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11220.exe
        6⤵
        
        PID:15960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59527.exe
        5⤵
        
        PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59772.exe
        5⤵
        
        PID:10456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18835.exe
        5⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34631.exe
        5⤵
        
        PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45915.exe
      4⤵
      PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        5⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        6⤵
        
        PID:13952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
        5⤵
        
        PID:10988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10822.exe
        5⤵
        
        PID:15036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
        5⤵
        
        PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44780.exe
      4⤵
      PID:8140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51107.exe
      4⤵
      PID:10512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53324.exe
      4⤵
      PID:14608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2995.exe
      4⤵
      PID:14288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59511.exe
      4⤵
      PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
        5⤵
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35895.exe
        5⤵
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe
        5⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6599.exe
        5⤵
        
        PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21427.exe
      4⤵
      PID:8464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21157.exe
        5⤵
        
        PID:7904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe
      4⤵
      PID:12128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10283.exe
      4⤵
      PID:15532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13251.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31796.exe
    3⤵
    - Executes dropped EXE
    PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
      4⤵
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42777.exe
        5⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-919.exe
        5⤵
        
        PID:10608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        5⤵
        
        PID:13328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56767.exe
        5⤵
        
        PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
      4⤵
      PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49596.exe
      4⤵
      PID:11732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15812.exe
      4⤵
      PID:15888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10203.exe
      4⤵
      PID:15948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8086.exe
    3⤵
    PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64069.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
        5⤵
        
        PID:9580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        5⤵
        
        PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18791.exe
      4⤵
      PID:11228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39219.exe
      4⤵
      PID:14872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52875.exe
      4⤵
      PID:15140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60368.exe
    3⤵
    PID:9264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43189.exe
    3⤵
    PID:12892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6895.exe
    3⤵
    PID:6712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65411.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65411.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61209.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27489.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25517.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4432.exe
        6⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        7⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5828.exe
        8⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
        9⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        9⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49096.exe
        9⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13363.exe
        8⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        8⤵
        
        PID:13032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44515.exe
        8⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
        7⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1428.exe
        8⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16118.exe
        8⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe
        7⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30431.exe
        7⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21693.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        7⤵
        
        PID:10792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46197.exe
        7⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13014.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9139.exe
        6⤵
        
        PID:12736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45086.exe
        6⤵
        
        PID:12976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25599.exe
        5⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32585.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40171.exe
        7⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44036.exe
        7⤵
        
        PID:15416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48907.exe
        7⤵
        
        PID:15528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48210.exe
        7⤵
        
        PID:13004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60540.exe
        6⤵
        
        PID:8848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        6⤵
        
        PID:11604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8330.exe
        6⤵
        
        PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19054.exe
        5⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe
        6⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41863.exe
        6⤵
        
        PID:12092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe
        6⤵
        
        PID:15732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15732 -s 464
        7⤵
        Program crash
        
        PID:15800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1047.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56212.exe
        5⤵
        
        PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54335.exe
        5⤵
        
        PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        5⤵
        
        PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54660.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        5⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
        6⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60097.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
        7⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60452.exe
        6⤵
        
        PID:10020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        6⤵
        
        PID:13916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52683.exe
        6⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12875.exe
        5⤵
        
        PID:7828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19358.exe
        5⤵
        
        PID:11592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65384.exe
        5⤵
        
        PID:15476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14380.exe
        5⤵
        
        PID:15560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26698.exe
      4⤵
      PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20333.exe
        5⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13524.exe
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        6⤵
        
        PID:12080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55659.exe
        6⤵
        
        PID:15716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11339.exe
        5⤵
        
        PID:8668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        5⤵
        
        PID:12204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51142.exe
        5⤵
        
        PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17675.exe
      4⤵
      PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe
        5⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60400.exe
        5⤵
        
        PID:10916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe
        5⤵
        
        PID:15208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        5⤵
        
        PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42503.exe
      4⤵
      PID:9036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28287.exe
      4⤵
      PID:10920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18188.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44380.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:60
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15267.exe
        5⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28865.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12403.exe
        6⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        6⤵
        
        PID:13696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27986.exe
        6⤵
        
        PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34446.exe
        5⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe
        6⤵
        
        PID:10832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16739.exe
        6⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61540.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38200.exe
        5⤵
        
        PID:7724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3362.exe
        5⤵
        
        PID:15276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
        5⤵
        
        PID:14904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-711.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe
        5⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41921.exe
        6⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12507.exe
        6⤵
        
        PID:11664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        6⤵
        
        PID:15384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60844.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48288.exe
        5⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        5⤵
        
        PID:11224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35931.exe
      4⤵
      PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8428.exe
        5⤵
        
        PID:10176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5631.exe
        5⤵
        
        PID:13936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37520.exe
      4⤵
      PID:9840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42275.exe
      4⤵
      PID:13228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40791.exe
      4⤵
      PID:14676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35465.exe
      4⤵
      PID:15932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47975.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
      4⤵
      PID:744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57281.exe
        5⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
        6⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6075.exe
        6⤵
        
        PID:16296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6958.exe
        5⤵
        
        PID:9936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9034.exe
        5⤵
        
        PID:14268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27790.exe
        5⤵
        
        PID:15420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38235.exe
      4⤵
      PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
        5⤵
        
        PID:8764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3143.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
        5⤵
        
        PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54780.exe
      4⤵
      PID:9564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59771.exe
      4⤵
      PID:12796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28517.exe
      4⤵
      PID:1296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
    3⤵
    PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
      4⤵
      PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45600.exe
        5⤵
        
        PID:7484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49631.exe
        5⤵
        
        PID:10864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4819.exe
        5⤵
        
        PID:14720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16648.exe
        5⤵
        
        PID:14440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
      4⤵
      PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6812.exe
        5⤵
        
        PID:15968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30195.exe
        5⤵
        
        PID:16280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53180.exe
        5⤵
        
        PID:15816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62075.exe
      4⤵
      PID:10796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17071.exe
      4⤵
      PID:15184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29027.exe
      4⤵
      PID:1288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-266.exe
    3⤵
    PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61381.exe
      4⤵
      PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
      4⤵
      PID:10896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64284.exe
      4⤵
      PID:4776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54940.exe
    3⤵
    PID:8812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45353.exe
    3⤵
    PID:12320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe
    3⤵
    PID:16172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65008.exe
    3⤵
    PID:15472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40723.exe
    3⤵
    PID:15784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7087.exe
    3⤵
    PID:5708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48500.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48500.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43441.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52865.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26965.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53301.exe
        6⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23997.exe
        7⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2943.exe
        7⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47439.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43051.exe
        6⤵
        
        PID:10732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39080.exe
        6⤵
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        6⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36751.exe
        5⤵
        
        PID:8004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2943.exe
        5⤵
        
        PID:11860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25702.exe
        5⤵
        
        PID:15504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
        5⤵
        
        PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        5⤵
        
        PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59692.exe
        5⤵
        
        PID:15496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
      4⤵
      PID:8896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
      4⤵
      PID:12800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
      4⤵
      PID:7544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36699.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5828.exe
        5⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        6⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48836.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        6⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58480.exe
        5⤵
        
        PID:10492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
        5⤵
        
        PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20582.exe
        5⤵
        
        PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41515.exe
      4⤵
      PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29368.exe
      4⤵
      PID:10628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31478.exe
      4⤵
      PID:16272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23138.exe
    3⤵
    PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe
      4⤵
      PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14980.exe
        5⤵
        
        PID:15916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57632.exe
        5⤵
        
        PID:16248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        5⤵
        
        PID:15200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39979.exe
      4⤵
      PID:10824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64491.exe
      4⤵
      PID:14744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63243.exe
      4⤵
      PID:15812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18687.exe
    3⤵
    PID:8752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe
    3⤵
    PID:11252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
    3⤵
    PID:15456
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18174.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18174.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6440.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31049.exe
      4⤵
      PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49217.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        6⤵
        
        PID:9400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48836.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41155.exe
        6⤵
        
        PID:15584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12339.exe
        6⤵
        
        PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60452.exe
        5⤵
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        5⤵
        
        PID:13928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19818.exe
        5⤵
        
        PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20711.exe
      4⤵
      PID:7456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
        5⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13231.exe
        5⤵
        
        PID:15152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57223.exe
      4⤵
      PID:11188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
      4⤵
      PID:14860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56760.exe
      4⤵
      PID:3632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13154.exe
    3⤵
    PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25777.exe
      4⤵
      PID:8540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
      4⤵
      PID:12180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55659.exe
      4⤵
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8288.exe
      4⤵
      PID:3264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15563.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15563.exe
    3⤵
    PID:9704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13878.exe
    3⤵
    PID:13136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17987.exe
    3⤵
    PID:6552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30857.exe
    3⤵
    PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32461.exe
        5⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48452.exe
        5⤵
        
        PID:13168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        5⤵
        
        PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48200.exe
      4⤵
      PID:10016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
      4⤵
      PID:13792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64743.exe
      4⤵
      PID:6188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7343.exe
    3⤵
    PID:7236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10896.exe
      4⤵
      PID:15904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25411.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61080.exe
    3⤵
    PID:11116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55059.exe
    3⤵
    PID:16036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
    3⤵
    PID:6556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19716.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19716.exe
  2⤵
  PID:5296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28901.exe
    3⤵
    PID:7896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
    3⤵
    PID:9928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64491.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64491.exe
    3⤵
    PID:14732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
  2⤵
  PID:8768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27999.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27999.exe
  2⤵
  PID:12136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37391.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37391.exe
  2⤵
  PID:5612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 16300 -ip 16300
1⤵
PID:15200

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe

Filesize
468KB

MD5
9330841ec36776f81f184e4894ddad68

SHA1
2f98690f38cf5d253742b415f6c92fed79f344de

SHA256
816a4345a9e8e6eb959d42b3747aabeec6947a7e486491f0c4685abfc195ac2e

SHA512
ca57a6c7c38a958b6b14deb16ce60e9960fd32a41b5666b436403e50e484fd9a0d015da339a158c7294c9b147f554b62829164e720e6be2951e999155a0b3d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10768.exe

Filesize
468KB

MD5
c66a9e3762faf67a9ab2ac22ae5ed5a8

SHA1
8122e1f36d6e074f9353bff0c9f66eb0b264db63

SHA256
dd0a09a5886cde55e01a1500452f9e20a2e8b0673c9ebf486da6df7b5e086e7b

SHA512
41f42c3b2367048ea2e324f9b04cdeb3adfdb96f1c02828ae0ec959d24526031e3ca9ec0bd27d861823b483993bf7d81c7716e581e0abe37a37863754954436c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12008.exe

Filesize
468KB

MD5
bfc28992034d4c518068fadffd126c35

SHA1
4f967da5169efa245a80cd7eaacce4f2e6627947

SHA256
d77ceaa077e85aba172617416806eeb50542b2101cf4a0cbc0ae271f482b4896

SHA512
c4cc09073b1b91441eb7eaf7b0703cbc63b71c95f0520c75ffc56a63bba1825419c42f979a6ab6dddb70a8569ffb6ea34e90531ba5de8effd66d26c0e40d6a96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14172.exe

Filesize
468KB

MD5
ffacce7e7ca2824e2183daa4c175f419

SHA1
e3f526e430975b405d0d966eda4c2c9492b4894c

SHA256
96874d0dd962ce42d315f686e184439d891d81f6af15ccc485746c87fd297926

SHA512
52fa951a2c0c6f3e17da7416a6efe5f5a8d0b10f93f38735fd0f05fa82eb3ff1dc7d5d658c63e323a5a22b31ad2f19f5a776502c6c0220b03935e8da3d7df960

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16197.exe

Filesize
468KB

MD5
630014f72b57fedb497c0cc96d053083

SHA1
544b976c5ef2f3d6cd3d9ad35d0ff0054301875c

SHA256
17fb6dc75dc1985e75f278f58e4c812e85a2d387b27877b5f5a47c35691154cf

SHA512
7155c4be1a692e4c53b0d39be308915fc8ae5085cb75195589ddac0a8eedde0a4de57cc9cdc0fa7048d0a4b40671ee527c5ff1892311af9180f2640a5926fbbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18174.exe

Filesize
468KB

MD5
4953b29d46dc77c3ac37a91de435f377

SHA1
331972bda2a3248c3043d62895f09e1bb3ef1269

SHA256
fd2c7030ab327a3578cd283f40a1c399ef2da5a7f7a04ec6d88b0419e2dd9e31

SHA512
a992e5434d1307942238af9a84c4926dbdc8fe916eef90ebb1dd70746981d94accf481ed19727af01d342b8a73677ccde2edc74cb7169390b5ec91522259f376

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22341.exe

Filesize
468KB

MD5
a824829ec11af9c62fae854f9a994f62

SHA1
6261194f839af54eab0a388ced181eaf0c2fad1d

SHA256
078b2d31afaac2457f45e111f5c27cbcaec6c3b52f13e8274ad73da13844e359

SHA512
526649bde5b535bb850471d90b6de3d4fee70e87a860a3402e67ca8bba7be53107bd72f20b02f8dc3bf9e31a2640366b814fcbb29ac792640a7ca4b5c2ad66d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23835.exe

Filesize
468KB

MD5
05fc3e5fcb95b977558a265a564e174c

SHA1
93b4129d449cc61cb5dff6a2eb15f406bc09d590

SHA256
2cb270aead8d33bc1950edb93ca196f4fc93f0dc33b3f87010fe6595885b773b

SHA512
55f341d78590abc73b104e705ff1f9d2a1c9d4dabef4543d7d360decd51cdbf0b2fd33ebc7121a26238fe63576939bd70b7320a4b9d7c5abd0ae9371d32d6247

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24261.exe

Filesize
468KB

MD5
a4cd0bc4a7a0d20f189d4acc42e9c21a

SHA1
ee8ca86ca8a16212c04efdeec224df25adf3b0df

SHA256
06e8828378dd23bb08118f4f436808e70462aea1853592bb749d3c58afe3828d

SHA512
033a73b20292b25a4faa3de2fa6ecea72e99afbee954227ec732752a0a96c3eebdf277cd0b6ef079c3ab75b21c22b66f4cbb4ba4e42a88e11b01fdcadf22cada

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24557.exe

Filesize
468KB

MD5
a59205c07fae32cbba916bc86885ee9b

SHA1
a67ac53571968652175eec5fb977e1aba1d47886

SHA256
99591991e21844624c42acd29c6c3024c403d8e08dd085da5af7e3f8aadd569a

SHA512
943b28b8116f4508daf99a16491edec3813dcf881188d3a364cf76493448b5f1a83c4476637255a0ae501bf72afde6126b2ab3069cceb7fb57a751c3f796243a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27489.exe

Filesize
468KB

MD5
9b703532e41ae78fd480c3ed67ef091c

SHA1
75bbe24b6f7553645c06e40a629b28f82205872a

SHA256
0d16bf037df926d692981c89e97b33ccd8914007bc1999765145801d6fa07d67

SHA512
d02c17c997afe35168c369b5764379dbdd2997c16e260361972c10f18708b9d3d641db94b7a81b9e4ad38098604d101f81e951a99953df1af5e10222b43b80a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27659.exe

Filesize
468KB

MD5
ef807cf04d5528b67888b91af42ab505

SHA1
bed5ee3e17f70b2c441fc7838e97ecddb420467a

SHA256
0ce11d30e8089b7fcf7c902b65c3d1cfc771bef0ab9de1a2cb59bd294f85cc54

SHA512
3b82e4776f3bc70bf146704108c1e1ba8df0a4575c4a8582f41ad6a517927f389f6c06448d7e6a4dac81412d50dc5de2e41ce9d9bab26210760050477897348a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28641.exe

Filesize
468KB

MD5
d2b119b4f31f2ea4f2a9562d8fb197c5

SHA1
048cf569b49e6af9b9a07a4553cca6a37d8d1dcc

SHA256
96c267d1da52da434a1a98065809626cf7f1f5f9fa53fc5cbb0be6ecdeb3e63d

SHA512
eccc09411b71f61d5cf474a4c618859b1d026d57eb256cc27fa82ac13b4a9ad550a8e9e6c31418f8926d49e02148d8b281157cbbdbffac2b948c498e629cf454

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31189.exe

Filesize
468KB

MD5
8edf18c0d906e4705f1499b1af7bb93f

SHA1
33025756058908b088bf1a44711cb368d736f80d

SHA256
a9de613e45e2d5933146537daa5d57e90e5c57f40e5577d66a8f94a67918fe2b

SHA512
7823d9e7ea62d288b5427735ab0a0dbd0cf02f10a815c79714fe02387f16b02159d7674cb5b972a5b7a1ef507066ce890273431bc37584ee8720c4b7c944680a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33145.exe

Filesize
468KB

MD5
aafca0bab113472766bee51f2114b633

SHA1
4f78aee82e2bcd03ad0dd211ea1813eef54f32b9

SHA256
77f109140e50b68ff37a3d34d20a1389031666444cd567453d64ba80fa691375

SHA512
276119a24f2103c2075b56890b0c54325cc91bde40c4f4db76599647bd52e7758bca7484fe2edb23f73a2eec844df98138ff0f1ad3843434b01046c607f0859f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34466.exe

Filesize
468KB

MD5
adb8c507459b093746fb29e3f264ca09

SHA1
92e1f846c7ad442bd3b52a581d133a058eb0b18e

SHA256
46c73c713b6c7f49c3d578c24608b102cdc560e02bf28d01d0cd02cf118877b4

SHA512
a10e6449853edcac206711a2253dee2d3e976f4975a2886c701f88d2260ff5c979bf64e14e98a7669d37312c1dfeab7bf54e5a747b04d7619b4b1b934ff836dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe

Filesize
468KB

MD5
0a78c852e16beabb0b3c1c50fb00c5b6

SHA1
e4f511aae0c85936180d6d2485b94c367788b2b8

SHA256
6ae985f6d1d3432cc95065c9c8d2c2be9dbaca097cbb131e923e79828ac30197

SHA512
082e27cce175dbb703a7e20944830dbfaedb7a0f688f65fbffaaea4769195b1ece7ba1257089b8e0b99354af1a0931e1a32c53fbbf16c17be3dfc9b326825387

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3679.exe

Filesize
468KB

MD5
18566443b78c2b8a3f80ded2cfb62bfe

SHA1
e86b693d228c881556ee46f9de4bb2742e949fe4

SHA256
9ef28d9376b1d17e0bd3ee832610159f5e201715536b9be6ae0539f18882617f

SHA512
3a89cbc93685bd215ab106fc57838e100ce6c616ed79b1e09bf935e219868bdb83abf7faba13425b10f332e18710241bf86eca684c5193483f5e2bc30cce5ad6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40171.exe

Filesize
468KB

MD5
d6d7eefd70d64563aeff884c42f03c99

SHA1
a1f459efbbe13c9cc8ca0c119f829cad17a6d542

SHA256
a15faaf2c44f31b5ab1295b5d49f771b1b24e4a257b48b15b8d85f6f5082b465

SHA512
66debb4d4efc2c5e9570819473860b46627833701a9481f07ad3e50e22061de224070c5f867a031aa9171202d7d58fdb3b8a19641237264f8badef9f2da7c4d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe

Filesize
468KB

MD5
5136df9985f7920b24729abe73b790f4

SHA1
8ca6f08e7f8414c4ca8233f2da0090a48769cefc

SHA256
81c9486ceaa40f2bfe95c253576b5734edeaa049d68214abf4e65e9651635177

SHA512
8ce3dad4494872c71e2759bf56dc206f319b4fc7f183c31e1eb7f39aceb82fea8649db19513cbddd6df0c42457436fdaafa3a001d738831f0749f9e6a21e6adf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe

Filesize
468KB

MD5
543b06bc068d0905611b18bdb0da53e5

SHA1
f2c18e4b05347e2127f859f7781c6ebe4bcd1f86

SHA256
609f0ee8c7c835f4d5bd9139f0d076c3c07fda77a4a701aa0380814f452a72ff

SHA512
3cce65c46792f05deeb38c85410bb4c23d8875d7b7631bfaa37fe0809bb7cd239e3002ef14d89dc6136c63e289b64dec31eb5b84e24ca746a28ea6fbe66214d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42865.exe

Filesize
468KB

MD5
43be075555a0c90fcd3a72bc4b8ae76c

SHA1
f6316dfb4f0b8a6cf659ee3869f6eabf3edda0e7

SHA256
590ebc1a7539a020f8f1ad91bf0f357caa6811a43685b170326ff93cede9af31

SHA512
31975a8febfa764b81b8c462dc791f949025f0b0c229939354b7a3d9dfd38e320007d3750640616494c0d302100fa1bd2ef5bc40d6fe0e00047b3674f849aa99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43441.exe

Filesize
468KB

MD5
993479e32fdb512221821998bb6b09ed

SHA1
53b9844de5619a9b6fd2b8c23a91a4e18d58a62b

SHA256
65f7f3e2718f9d2a1a60175365fd427bc41a79ce701f6d5d85d77be416809b61

SHA512
611f06db9dc4580b7cf0f1b751cfe82cb1cd9f45b923018eb1af56fcc92026330df34232bee34197491127cb10b68e60b7be2cef10ed85cafb73765693b8323a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44380.exe

Filesize
468KB

MD5
00d06af05b53b46dc34b04332acc1c25

SHA1
02dc6f8e785dcfd78c538c6eb882957fd7407a9f

SHA256
106106eca65239f09d9ef5649c0e55f398753ba7de351d9f5b39e5698d829f01

SHA512
5f4b150a2d3ff2e5862bfb20c69ca9d9b2797947b865ad1ce2cb32a4f625570c2298d8fd4b011f804527e5ec9af6df5dc42328b1f4293439388590e02978a4ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48500.exe

Filesize
468KB

MD5
93dfedbc9d07f95af165b0b09dcbead9

SHA1
ae7353d2ac8cc825dbba6870b05a8a94b1a38e76

SHA256
f538b17ad03c906a6e8f3b41e496fbac8be9e2f7a9c81517fdb324eceaff2a72

SHA512
834e2d8c3accddec38795d73779857f30ab39b34e4157c494443f96588be155fe6c7faae469fcf681dd5b974e1da5ba274e7289a2fcbd43a8ce07d3ff215f596

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48765.exe

Filesize
468KB

MD5
869cabeba453d5d979a17462b844dfc9

SHA1
0b756eb111916a4b2d72768656e183e619528af8

SHA256
f9a4e72f812450581d47b4762ddc8e7d2a1f585dca822eba412c8110f6637ed2

SHA512
2c6dccb22059cdcd869aab946d58d2b7d0c0b7dd8c96edfe356bbbab0d2f4221649bfaf1abc86b634a75edd2e5864ddc3efaf5f8d25fa9bc2ee83ac4826b554e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49512.exe

Filesize
468KB

MD5
b7502c9e0dd3b140d8883885ac9a32c2

SHA1
86c16f87d97f5c08953c3c103b94c562d0d25492

SHA256
468e4684c77a27acdd46a43d0a342cbb0e4c6c1ea21d24f8f9b4b80b4010668f

SHA512
39bf593420dc3f326fc2e4126ee0a0dcd9935d37d0e4d2de6229f66c9b416ba9e0036dfbdef81675573a50ab44dff22a7c7e208b597891aef11d92bed215e195

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49616.exe

Filesize
468KB

MD5
f4a7480925ddc4bda13fffb634dce08c

SHA1
0b473b9acf595ce9f07198045c1f37fd6140a94f

SHA256
d48aabca98ee6df6b3eab2f23b849640ab67754c91c39700bd26fc1c70b3ea51

SHA512
db98060b23ae9187e02a5e565bc5759b4823054932b87a62501edb7f07b04df938ad58eafde8193ac1fb39b04e554b34b6a3aab3110d969d03c3a0ddd09aadec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51676.exe

Filesize
468KB

MD5
ef8000b29a62a03a40378c83558cec01

SHA1
14689189fab82ed4244e46a9541051a39624bd9f

SHA256
f65101dc6af96cf824143b12bb3b11bdab78c11e69e31f939da8a51d7be93902

SHA512
39bedd4fa9d20039abee3ecba9b16ff3f9423cb1ae040d0257e49677f8a818bc2290e6a440f8d4e80712a9714b7e3a5adeb8a71cc1d7543108f5c9a9fd40da5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53596.exe

Filesize
468KB

MD5
768ca855d0099b99240bf8906be74e7b

SHA1
5ced5dd96dbb9cb5c29c3a73ebe6e09b398250f5

SHA256
9d4fc72c6f1f8504065ee813073fb9b39612f14585f6689b5233c8be7a2105bd

SHA512
9e94cb7a526140e8e6489bbc2841ca2ad155a3c3c5897c17ab132164bbf09f1f76f735c64a6a91ea9e503291622bece0124c897ca6cc8b4ab4e6701f23b07165

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61080.exe

Filesize
468KB

MD5
99d6548bfcbc0e187e18d697bd5f0695

SHA1
334b241b74eba83027a15d46c09dcba6812901ff

SHA256
09dad64a08877b4af95226c5b2ae479484ba05ad148433830140b707b7a94cae

SHA512
b62ee20e6c444c59d2f9452b247d2f19a37277d93fc581c7395d8b264fa86639e3dd56a2ff9f2197fdf378a33cc099ac70ca93ef4d4ffd93c34110485b77c386

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61209.exe

Filesize
468KB

MD5
53ac9c2e935e85b82de484aa48716dd1

SHA1
39d8bce5ed55a766f929d7b759b734d85c011b9b

SHA256
931098ca2912f490d5341e6171f84d2b15f36e23eed4e5219428e78bc99dbd9f

SHA512
ec592c235ac2d7757fff21f18c5c2349068bd4d6e507013313a0ccc32698cd6c366c976672c2ce9245fd4ae6c22380800c8deb3c5fb04256540b8de6aafe8772

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe

Filesize
468KB

MD5
6e59719b47ccf61cd6f845dd2436dac1

SHA1
d42a9bee4947611792b638fd2e5431443f6c4e57

SHA256
bf1c94a1702281a04aa45c014abdb354bdb84cf7337011ec07aa27dca4d8090d

SHA512
e1c9d146098a2628f896db5b4c278cee53f05c3669992260d5479c5fdc001ca018ce50082b00f900f6b12807a56addd2e2b1a1368c14acb0a8fc3f372e050ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64053.exe

Filesize
468KB

MD5
a53553622a193d49e96579a943f3442f

SHA1
0ce8b2052176967f5230a73c440beefc1d4ea7f7

SHA256
c5543931af95f1fd9d9af3bf18b87a9c6828341acca5117510394d211bfbc690

SHA512
609068750512b05d363d39eb1dded09751e934d11f25923e494242d2b1170b4b60917caa78a39e0d9e1d99eaf84ce69cb7c3469834d90fb317499d5d1ef65077

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65411.exe

Filesize
468KB

MD5
e38f98b8796b76c9f070419dc9b4900b

SHA1
0b12a144704132ce3497161f463a37c49bb98007

SHA256
d34e5f31fae5712f84ef06ab37fade22705abb54e11ee7a735c3453d56ef93e4

SHA512
650482c0440aa098bb473242fd3d88c7daf3c7056512bb064772e32ca95fb473db3db7f7813b0080a261f71fbaf64587545cc6d1d80f5f31ae9a00426d2a0111

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6663.exe

Filesize
468KB

MD5
f7cc0ef68d4e83289ba77fa54becfc1c

SHA1
35323560b343338e5eb245d1f985a44109963b5a

SHA256
e441919ba6c842f79265d7fb640098e9a3653fa7f3149621254f6187868f8f32

SHA512
faaf1f0306191b79677b7cea1bc0e69e64e949eba50ad4ae8e758d7dedf1c6955a02b58f1745f2ec7d7d3ae5bc57f0bd34437f412f40b19f2a392e5d8063b338

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8028.exe

Filesize
468KB

MD5
675c54aa198f3adc67d8dbc93665dbef

SHA1
0ee29dbc0b547b2408cd8517f687a34feb4d10eb

SHA256
197720ac82130521f449c2960e3b8f52f253f26bea65d9a3e3ee5c26780cb9e2

SHA512
48307621f6ad907b11140c0f2c724c5e937a73294ef2b7429eefcc9c173e59331bfad0ae9ccc390da9f80ce45dc329b0aeb4a680f68e5a75f8979ff41bb02f35

Download Submit
memory/60-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/400-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/412-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/744-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/840-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/908-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/960-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1020-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1128-203-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1196-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1328-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1356-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1368-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1400-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1456-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1748-149-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1800-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2116-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2156-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2292-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2336-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2344-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2560-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2672-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2804-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2840-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2932-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3092-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3100-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3160-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3196-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3248-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3256-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3276-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3280-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3452-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3540-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3608-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3612-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3756-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3844-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3888-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3916-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4008-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4048-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4100-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4112-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4136-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4148-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4204-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4420-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4476-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4544-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4588-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4604-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4620-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4760-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4808-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4880-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4900-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4916-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4968-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5080-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5104-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5140-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5184-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5192-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5208-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5220-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5300-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5316-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5340-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5400-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5424-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5592-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5624-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5648-493-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5712-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5780-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5792-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5804-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5820-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5848-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5868-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5888-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5960-556-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5972-557-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6072-571-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15476-2816-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15528-3083-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15616-3091-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15884-2577-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16344-2630-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads