aa86e8c139af10e179dd7b90d878e5f01f130bfc32645d932897cbbe015cc03f

Analysis

max time kernel
120s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 06:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aa86e8c139af10e179dd7b90d878e5f01f130bfc32645d932897cbbe015cc03fN.exe
Size

468KB
MD5

09afcbc2082e29c2f6cbf745d55354b0
SHA1

a395b5c58879f40e7d184b8194a333fe8cb3db54
SHA256

aa86e8c139af10e179dd7b90d878e5f01f130bfc32645d932897cbbe015cc03f
SHA512

155ed2922440d556e95c06dc2a66704199bcfb9a095031ca6caa56c3e3af11fe9ffe02fb3a467f488dff91c93f5b2ff62493e0eecc8ba8dd3aa63d5cf33e794c
SSDEEP

3072:iZCCogOxjq8UdbYSPzbCqf8vlehsHDpTdmHBYVfeLjD30G2tmulj:iZfoBTUdJPvCqfSd8RLjbj2tm

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3244	Unicorn-55046.exe
3056	Unicorn-5373.exe
2208	Unicorn-1844.exe
4580	Unicorn-38918.exe
2848	Unicorn-57174.exe
1464	Unicorn-49975.exe
4788	Unicorn-36239.exe
1636	Unicorn-32569.exe
3156	Unicorn-37207.exe
4992	Unicorn-39393.exe
1716	Unicorn-39393.exe
4852	Unicorn-10019.exe
4140	Unicorn-16150.exe
4824	Unicorn-24053.exe
3456	Unicorn-20788.exe
3924	Unicorn-57670.exe
3936	Unicorn-6175.exe
1020	Unicorn-34593.exe
1124	Unicorn-11851.exe
4972	Unicorn-49585.exe
2684	Unicorn-12043.exe
2252	Unicorn-33441.exe
2300	Unicorn-64037.exe
3468	Unicorn-18366.exe
392	Unicorn-34702.exe
3640	Unicorn-51624.exe
680	Unicorn-32023.exe
3416	Unicorn-42959.exe
4264	Unicorn-51889.exe
3008	Unicorn-32023.exe
3760	Unicorn-11069.exe
4960	Unicorn-7540.exe
3644	Unicorn-52294.exe
5100	Unicorn-62884.exe
4584	Unicorn-50301.exe
1936	Unicorn-12989.exe
3792	Unicorn-12989.exe
2852	Unicorn-8391.exe
2872	Unicorn-2600.exe
2540	Unicorn-11764.exe
4680	Unicorn-48464.exe
636	Unicorn-19513.exe
2340	Unicorn-64311.exe
3616	Unicorn-29409.exe
4948	Unicorn-61703.exe
2768	Unicorn-29601.exe
4460	Unicorn-14525.exe
4512	Unicorn-5288.exe
2728	Unicorn-21625.exe
2260	Unicorn-55366.exe
4860	Unicorn-6549.exe
4820	Unicorn-419.exe
1484	Unicorn-5480.exe
2692	Unicorn-4519.exe
2912	Unicorn-10119.exe
4368	Unicorn-64612.exe
2248	Unicorn-4940.exe
444	Unicorn-56710.exe
3200	Unicorn-3295.exe
1628	Unicorn-23161.exe
4876	Unicorn-17030.exe
5020	Unicorn-14909.exe
3568	Unicorn-22009.exe
3708	Unicorn-10311.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
12520	7064	WerFault.exe	275
15968	14224	WerFault.exe	676
16012	14128	WerFault.exe	681
17708	17256	WerFault.exe	994
6940	7328	WerFault.exe	336

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64037.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36511.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16696	dwm.exe
Token: SeChangeNotifyPrivilege	16696	dwm.exe
Token: 33	16696	dwm.exe
Token: SeIncBasePriorityPrivilege	16696	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3444	aa86e8c139af10e179dd7b90d878e5f01f130bfc32645d932897cbbe015cc03fN.exe
3244	Unicorn-55046.exe
3056	Unicorn-5373.exe
2208	Unicorn-1844.exe
1464	Unicorn-49975.exe
2848	Unicorn-57174.exe
4580	Unicorn-38918.exe
4788	Unicorn-36239.exe
1636	Unicorn-32569.exe
3156	Unicorn-37207.exe
3456	Unicorn-20788.exe
4824	Unicorn-24053.exe
4852	Unicorn-10019.exe
4140	Unicorn-16150.exe
4992	Unicorn-39393.exe
1716	Unicorn-39393.exe
3924	Unicorn-57670.exe
3936	Unicorn-6175.exe
1020	Unicorn-34593.exe
4972	Unicorn-49585.exe
1124	Unicorn-11851.exe
392	Unicorn-34702.exe
2252	Unicorn-33441.exe
2684	Unicorn-12043.exe
2300	Unicorn-64037.exe
3640	Unicorn-51624.exe
4264	Unicorn-51889.exe
3008	Unicorn-32023.exe
3468	Unicorn-18366.exe
3416	Unicorn-42959.exe
680	Unicorn-32023.exe
3760	Unicorn-11069.exe
4960	Unicorn-7540.exe
3644	Unicorn-52294.exe
5100	Unicorn-62884.exe
4584	Unicorn-50301.exe
3792	Unicorn-12989.exe
1936	Unicorn-12989.exe
2852	Unicorn-8391.exe
2872	Unicorn-2600.exe
2540	Unicorn-11764.exe
4680	Unicorn-48464.exe
636	Unicorn-19513.exe
2340	Unicorn-64311.exe
3616	Unicorn-29409.exe
4948	Unicorn-61703.exe
4460	Unicorn-14525.exe
4512	Unicorn-5288.exe
2912	Unicorn-10119.exe
4368	Unicorn-64612.exe
1484	Unicorn-5480.exe
2728	Unicorn-21625.exe
2260	Unicorn-55366.exe
2692	Unicorn-4519.exe
4820	Unicorn-419.exe
2248	Unicorn-4940.exe
4860	Unicorn-6549.exe
444	Unicorn-56710.exe
5020	Unicorn-14909.exe
4876	Unicorn-17030.exe
3200	Unicorn-3295.exe
1628	Unicorn-23161.exe
3568	Unicorn-22009.exe
740	Unicorn-55485.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 3244	3444	aa86e8c139af10e179dd7b90d878e5f01f130bfc32645d932897cbbe015cc03fN.exe	86
PID 3444 wrote to memory of 3244	3444	aa86e8c139af10e179dd7b90d878e5f01f130bfc32645d932897cbbe015cc03fN.exe	86
PID 3444 wrote to memory of 3244	3444	aa86e8c139af10e179dd7b90d878e5f01f130bfc32645d932897cbbe015cc03fN.exe	86
PID 3244 wrote to memory of 3056	3244	Unicorn-55046.exe	88
PID 3244 wrote to memory of 3056	3244	Unicorn-55046.exe	88
PID 3244 wrote to memory of 3056	3244	Unicorn-55046.exe	88
PID 3444 wrote to memory of 2208	3444	aa86e8c139af10e179dd7b90d878e5f01f130bfc32645d932897cbbe015cc03fN.exe	89
PID 3444 wrote to memory of 2208	3444	aa86e8c139af10e179dd7b90d878e5f01f130bfc32645d932897cbbe015cc03fN.exe	89
PID 3444 wrote to memory of 2208	3444	aa86e8c139af10e179dd7b90d878e5f01f130bfc32645d932897cbbe015cc03fN.exe	89
PID 3056 wrote to memory of 4580	3056	Unicorn-5373.exe	92
PID 3056 wrote to memory of 4580	3056	Unicorn-5373.exe	92
PID 3056 wrote to memory of 4580	3056	Unicorn-5373.exe	92
PID 2208 wrote to memory of 2848	2208	Unicorn-1844.exe	93
PID 2208 wrote to memory of 2848	2208	Unicorn-1844.exe	93
PID 2208 wrote to memory of 2848	2208	Unicorn-1844.exe	93
PID 3444 wrote to memory of 1464	3444	aa86e8c139af10e179dd7b90d878e5f01f130bfc32645d932897cbbe015cc03fN.exe	94
PID 3444 wrote to memory of 1464	3444	aa86e8c139af10e179dd7b90d878e5f01f130bfc32645d932897cbbe015cc03fN.exe	94
PID 3444 wrote to memory of 1464	3444	aa86e8c139af10e179dd7b90d878e5f01f130bfc32645d932897cbbe015cc03fN.exe	94
PID 3244 wrote to memory of 4788	3244	Unicorn-55046.exe	95
PID 3244 wrote to memory of 4788	3244	Unicorn-55046.exe	95
PID 3244 wrote to memory of 4788	3244	Unicorn-55046.exe	95
PID 2848 wrote to memory of 1636	2848	Unicorn-57174.exe	96
PID 2848 wrote to memory of 1636	2848	Unicorn-57174.exe	96
PID 2848 wrote to memory of 1636	2848	Unicorn-57174.exe	96
PID 2208 wrote to memory of 3156	2208	Unicorn-1844.exe	97
PID 2208 wrote to memory of 3156	2208	Unicorn-1844.exe	97
PID 2208 wrote to memory of 3156	2208	Unicorn-1844.exe	97
PID 4788 wrote to memory of 4992	4788	Unicorn-36239.exe	98
PID 4788 wrote to memory of 4992	4788	Unicorn-36239.exe	98
PID 4788 wrote to memory of 4992	4788	Unicorn-36239.exe	98
PID 1464 wrote to memory of 1716	1464	Unicorn-49975.exe	99
PID 1464 wrote to memory of 1716	1464	Unicorn-49975.exe	99
PID 1464 wrote to memory of 1716	1464	Unicorn-49975.exe	99
PID 3244 wrote to memory of 4852	3244	Unicorn-55046.exe	100
PID 3244 wrote to memory of 4852	3244	Unicorn-55046.exe	100
PID 3244 wrote to memory of 4852	3244	Unicorn-55046.exe	100
PID 4580 wrote to memory of 4140	4580	Unicorn-38918.exe	101
PID 4580 wrote to memory of 4140	4580	Unicorn-38918.exe	101
PID 4580 wrote to memory of 4140	4580	Unicorn-38918.exe	101
PID 3444 wrote to memory of 4824	3444	aa86e8c139af10e179dd7b90d878e5f01f130bfc32645d932897cbbe015cc03fN.exe	102
PID 3444 wrote to memory of 4824	3444	aa86e8c139af10e179dd7b90d878e5f01f130bfc32645d932897cbbe015cc03fN.exe	102
PID 3444 wrote to memory of 4824	3444	aa86e8c139af10e179dd7b90d878e5f01f130bfc32645d932897cbbe015cc03fN.exe	102
PID 3056 wrote to memory of 3456	3056	Unicorn-5373.exe	103
PID 3056 wrote to memory of 3456	3056	Unicorn-5373.exe	103
PID 3056 wrote to memory of 3456	3056	Unicorn-5373.exe	103
PID 1636 wrote to memory of 3924	1636	Unicorn-32569.exe	104
PID 1636 wrote to memory of 3924	1636	Unicorn-32569.exe	104
PID 1636 wrote to memory of 3924	1636	Unicorn-32569.exe	104
PID 2848 wrote to memory of 3936	2848	Unicorn-57174.exe	105
PID 2848 wrote to memory of 3936	2848	Unicorn-57174.exe	105
PID 2848 wrote to memory of 3936	2848	Unicorn-57174.exe	105
PID 3156 wrote to memory of 1020	3156	Unicorn-37207.exe	106
PID 3156 wrote to memory of 1020	3156	Unicorn-37207.exe	106
PID 3156 wrote to memory of 1020	3156	Unicorn-37207.exe	106
PID 2208 wrote to memory of 1124	2208	Unicorn-1844.exe	107
PID 2208 wrote to memory of 1124	2208	Unicorn-1844.exe	107
PID 2208 wrote to memory of 1124	2208	Unicorn-1844.exe	107
PID 3456 wrote to memory of 4972	3456	Unicorn-20788.exe	108
PID 3456 wrote to memory of 4972	3456	Unicorn-20788.exe	108
PID 3456 wrote to memory of 4972	3456	Unicorn-20788.exe	108
PID 3056 wrote to memory of 2684	3056	Unicorn-5373.exe	109
PID 3056 wrote to memory of 2684	3056	Unicorn-5373.exe	109
PID 3056 wrote to memory of 2684	3056	Unicorn-5373.exe	109
PID 4140 wrote to memory of 2252	4140	Unicorn-16150.exe	110

C:\Users\Admin\AppData\Local\Temp\aa86e8c139af10e179dd7b90d878e5f01f130bfc32645d932897cbbe015cc03fN.exe
"C:\Users\Admin\AppData\Local\Temp\aa86e8c139af10e179dd7b90d878e5f01f130bfc32645d932897cbbe015cc03fN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55046.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55046.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5373.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16150.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33441.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21625.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8573.exe
        8⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40124.exe
        8⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        9⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55068.exe
        9⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39515.exe
        9⤵
        
        PID:16840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10630.exe
        8⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42573.exe
        8⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30465.exe
        8⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36476.exe
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53374.exe
        8⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15969.exe
        9⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49184.exe
        8⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        8⤵
        
        PID:15064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        8⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31395.exe
        7⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12183.exe
        7⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20083.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52916.exe
        7⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35875.exe
        6⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        7⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        7⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58538.exe
        7⤵
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65493.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
        6⤵
        
        PID:12696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26097.exe
        6⤵
        
        PID:17340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64037.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19513.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47494.exe
        7⤵
        
        PID:60
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        8⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        9⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        9⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        9⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        8⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8333.exe
        9⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        9⤵
        
        PID:16300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61051.exe
        9⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22397.exe
        8⤵
        
        PID:12704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54882.exe
        8⤵
        
        PID:17268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40124.exe
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        8⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        8⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
        8⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6895.exe
        7⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
        7⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14314.exe
        7⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
        7⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        8⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        8⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exe
        8⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1799.exe
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        7⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30849.exe
        7⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42999.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        7⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        7⤵
        
        PID:14912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16495.exe
        6⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
        6⤵
        
        PID:14252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62044.exe
        6⤵
        
        PID:16416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64311.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        6⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33094.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        8⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        8⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exe
        8⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23703.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55738.exe
        7⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17836.exe
        6⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49926.exe
        7⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        7⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14729.exe
        7⤵
        
        PID:17148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
        6⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50549.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47378.exe
        6⤵
        
        PID:396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22341.exe
        5⤵
        
        PID:744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43846.exe
        6⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1768.exe
        7⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        7⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        6⤵
        
        PID:8688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50247.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7418.exe
        6⤵
        
        PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-702.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40305.exe
        6⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2796.exe
        6⤵
        
        PID:12724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16841.exe
        6⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18295.exe
        5⤵
        
        PID:8292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47977.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18977.exe
        5⤵
        
        PID:16252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20788.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2600.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20878.exe
        7⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43078.exe
        8⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51846.exe
        9⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        9⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33649.exe
        9⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
        8⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
        8⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14321.exe
        8⤵
        
        PID:16568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54261.exe
        7⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        8⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
        8⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29147.exe
        8⤵
        
        PID:16924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37247.exe
        7⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe
        7⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47370.exe
        7⤵
        
        PID:17036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50405.exe
        6⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51542.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21006.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
        8⤵
        
        PID:14128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14128 -s 436
        9⤵
        Program crash
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33841.exe
        8⤵
        
        PID:17308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
        7⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8551.exe
        7⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
        7⤵
        
        PID:17184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37239.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21198.exe
        7⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
        7⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47874.exe
        7⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59756.exe
        6⤵
        
        PID:14320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        6⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63830.exe
        6⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41734.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11197.exe
        8⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55068.exe
        8⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6842.exe
        8⤵
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62232.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50814.exe
        8⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
        8⤵
        
        PID:17216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38519.exe
        7⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44976.exe
        7⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        7⤵
        
        PID:16244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29263.exe
        6⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12528.exe
        7⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29796.exe
        8⤵
        
        PID:16728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42660.exe
        7⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36423.exe
        7⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52386.exe
        7⤵
        
        PID:16992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20243.exe
        6⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
        6⤵
        
        PID:15860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9898.exe
        6⤵
        
        PID:10884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41364.exe
        5⤵
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        7⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        7⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9721.exe
        7⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63012.exe
        6⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe
        6⤵
        
        PID:14224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14224 -s 436
        7⤵
        Program crash
        
        PID:15968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65008.exe
        5⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51654.exe
        6⤵
        
        PID:9228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29494.exe
        6⤵
        
        PID:14468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26355.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15806.exe
        5⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        5⤵
        
        PID:11640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12043.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6549.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65174.exe
        6⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        7⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        7⤵
        
        PID:13984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56043.exe
        7⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57240.exe
        6⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48489.exe
        7⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-977.exe
        7⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20839.exe
        6⤵
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
        6⤵
        
        PID:16280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36092.exe
        5⤵
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26465.exe
        6⤵
        
        PID:9388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        6⤵
        
        PID:13964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6562.exe
        6⤵
        
        PID:17400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
        5⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38406.exe
        6⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23839.exe
        6⤵
        
        PID:14968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61051.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2967.exe
        5⤵
        
        PID:11392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        5⤵
        
        PID:15720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
        5⤵
        
        PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4940.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14712.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43846.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1768.exe
        7⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        7⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39707.exe
        7⤵
        
        PID:17052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        6⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42764.exe
        6⤵
        
        PID:13136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48451.exe
        6⤵
        
        PID:992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6487.exe
        5⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        6⤵
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37631.exe
        5⤵
        
        PID:8248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56112.exe
        5⤵
        
        PID:12452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7305.exe
        5⤵
        
        PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21070.exe
      4⤵
      PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39062.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60917.exe
        5⤵
        
        PID:10424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5971.exe
        5⤵
        
        PID:14440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        5⤵
        
        PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
      4⤵
      PID:7868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60369.exe
      4⤵
      PID:11400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
      4⤵
      PID:15492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32770.exe
      4⤵
      PID:6784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36239.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39393.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50301.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40198.exe
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        8⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46304.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe
        8⤵
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15447.exe
        7⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
        7⤵
        
        PID:13624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30266.exe
        7⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40124.exe
        6⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52038.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48821.exe
        7⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33649.exe
        7⤵
        
        PID:16532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19291.exe
        6⤵
        
        PID:8456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62744.exe
        6⤵
        
        PID:12900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37289.exe
        6⤵
        
        PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6278.exe
        5⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65470.exe
        6⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        7⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        7⤵
        
        PID:14132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39515.exe
        7⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        6⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65052.exe
        6⤵
        
        PID:11656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe
        6⤵
        
        PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1199.exe
        5⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8525.exe
        6⤵
        
        PID:12296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23380.exe
        6⤵
        
        PID:15756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61051.exe
        6⤵
        
        PID:17640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34830.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28274.exe
        6⤵
        
        PID:16492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        5⤵
        
        PID:13208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48484.exe
        5⤵
        
        PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32023.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29601.exe
        5⤵
        Executes dropped EXE
        
        PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18583.exe
        5⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
        6⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        7⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        7⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
        6⤵
        
        PID:7472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25555.exe
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22489.exe
        6⤵
        
        PID:15504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2459.exe
        5⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        6⤵
        
        PID:14152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56043.exe
        6⤵
        
        PID:16468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43112.exe
        5⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47447.exe
        5⤵
        
        PID:12528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39970.exe
        5⤵
        
        PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-419.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65174.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
        6⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12157.exe
        7⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        7⤵
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50754.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39188.exe
        6⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32864.exe
        6⤵
        
        PID:12380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
        6⤵
        
        PID:16520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
        5⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30513.exe
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57965.exe
        6⤵
        
        PID:13544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe
        6⤵
        
        PID:17544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62919.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36320.exe
        5⤵
        
        PID:15076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55266.exe
        5⤵
        
        PID:17384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
      4⤵
      PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40982.exe
        5⤵
        
        PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60917.exe
        5⤵
        
        PID:10492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5971.exe
        5⤵
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52386.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15907.exe
      4⤵
      PID:7824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44455.exe
      4⤵
      PID:11320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37801.exe
      4⤵
      PID:14792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
      4⤵
      PID:7164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10019.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51889.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5288.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22689.exe
        6⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58921.exe
        7⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52998.exe
        8⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
        8⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        8⤵
        
        PID:16576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44176.exe
        7⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33251.exe
        7⤵
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59707.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17256 -s 212
        8⤵
        Program crash
        
        PID:17708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41764.exe
        6⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        7⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        7⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9721.exe
        7⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60428.exe
        6⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50549.exe
        6⤵
        
        PID:13588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30849.exe
        6⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10135.exe
        5⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        6⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57742.exe
        7⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50579.exe
        7⤵
        
        PID:16428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        6⤵
        
        PID:12592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
        6⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49351.exe
        5⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53148.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2967.exe
        5⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27578.exe
        5⤵
        
        PID:15788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39933.exe
      4⤵
      PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1576.exe
        6⤵
        
        PID:8412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        6⤵
        
        PID:12164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        6⤵
        
        PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        5⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37772.exe
        5⤵
        
        PID:14304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39707.exe
        5⤵
        
        PID:17752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12814.exe
      4⤵
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30513.exe
        5⤵
        
        PID:10508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57773.exe
        5⤵
        
        PID:15048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61051.exe
        5⤵
        
        PID:620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
      4⤵
      PID:11196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28185.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
      4⤵
      PID:5540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51624.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7037.exe
        5⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19726.exe
        6⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        7⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        7⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9721.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27564.exe
        6⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23933.exe
        6⤵
        
        PID:13096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe
        6⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40420.exe
        5⤵
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11768.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
        6⤵
        
        PID:14236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        6⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        5⤵
        
        PID:9580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12380.exe
        5⤵
        
        PID:14972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62324.exe
        5⤵
        
        PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
      4⤵
      PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38086.exe
        5⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28494.exe
        6⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        6⤵
        
        PID:11356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        6⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38991.exe
        5⤵
        
        PID:9772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21907.exe
        5⤵
        
        PID:13780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31347.exe
        5⤵
        
        PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15038.exe
      4⤵
      PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe
        5⤵
        
        PID:11336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49794.exe
        5⤵
        
        PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61685.exe
      4⤵
      PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34198.exe
        5⤵
        
        PID:13108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9546.exe
        5⤵
        
        PID:17324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27654.exe
      4⤵
      PID:15108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37002.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64489.exe
      4⤵
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7520.exe
        5⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        6⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        6⤵
        
        PID:14028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        6⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64736.exe
        5⤵
        
        PID:9200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50247.exe
        5⤵
        
        PID:13232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7418.exe
        5⤵
        
        PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23311.exe
      4⤵
      PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11021.exe
        5⤵
        
        PID:10708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43252.exe
        5⤵
        
        PID:14868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64402.exe
        5⤵
        
        PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55332.exe
      4⤵
      PID:10228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59257.exe
        5⤵
        
        PID:14156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9546.exe
        5⤵
        
        PID:16876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe
      4⤵
      PID:14312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
      4⤵
      PID:16484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64872.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
      4⤵
      PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52998.exe
        5⤵
        
        PID:8700
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7064 -s 716
        5⤵
        Program crash
        
        PID:12520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14679.exe
      4⤵
      PID:9844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
      4⤵
      PID:13976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7034.exe
      4⤵
      PID:17004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
    3⤵
    PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
      4⤵
      PID:12008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
      4⤵
      PID:16216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
      4⤵
      PID:6064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
    3⤵
    PID:11180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17847.exe
    3⤵
    PID:15172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55714.exe
    3⤵
    PID:17248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1844.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1844.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57174.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32569.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57670.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56710.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16249.exe
        8⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43316.exe
        9⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe
        9⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11452.exe
        9⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
        9⤵
        
        PID:17428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2860.exe
        8⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
        8⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14698.exe
        8⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50784.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        8⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        8⤵
        
        PID:14036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
        8⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58671.exe
        7⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe
        7⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21043.exe
        7⤵
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
        7⤵
        
        PID:14892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3295.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40369.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4173.exe
        8⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
        8⤵
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        8⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39323.exe
        8⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
        7⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31699.exe
        7⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        7⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35850.exe
        7⤵
        
        PID:16388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe
        6⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1768.exe
        7⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        7⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17889.exe
        7⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
        6⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59839.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3439.exe
        6⤵
        
        PID:15812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26964.exe
        6⤵
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23161.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-981.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57510.exe
        8⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65432.exe
        8⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22774.exe
        8⤵
        
        PID:15744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10210.exe
        8⤵
        
        PID:10848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17935.exe
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33427.exe
        7⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43440.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
        7⤵
        
        PID:17420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45413.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64041.exe
        7⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
        8⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50579.exe
        8⤵
        
        PID:16452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62364.exe
        7⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62011.exe
        7⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        6⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62448.exe
        6⤵
        
        PID:11544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
        6⤵
        
        PID:15892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9898.exe
        6⤵
        
        PID:10820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17030.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
        7⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48489.exe
        8⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23380.exe
        8⤵
        
        PID:15764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8289.exe
        8⤵
        
        PID:17576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe
        7⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31715.exe
        7⤵
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
        6⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-646.exe
        6⤵
        
        PID:10564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37301.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35850.exe
        6⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        5⤵
        
        PID:528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        6⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55068.exe
        6⤵
        
        PID:14512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59832.exe
        5⤵
        
        PID:11476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36841.exe
        5⤵
        
        PID:15536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
        5⤵
        
        PID:16400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6175.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14909.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-981.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45974.exe
        8⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
        9⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
        9⤵
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61051.exe
        9⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        8⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46599.exe
        8⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39515.exe
        8⤵
        
        PID:15940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
        7⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44758.exe
        8⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50579.exe
        8⤵
        
        PID:16460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
        7⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        7⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35850.exe
        7⤵
        
        PID:16944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10135.exe
        6⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61088.exe
        7⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        8⤵
        
        PID:16332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43178.exe
        8⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42572.exe
        7⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48067.exe
        7⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33014.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21043.exe
        6⤵
        
        PID:15584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42570.exe
        6⤵
        
        PID:10796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe
        5⤵
        Executes dropped EXE
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49990.exe
        6⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38086.exe
        7⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        8⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59306.exe
        8⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
        7⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
        7⤵
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31041.exe
        7⤵
        
        PID:16404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1303.exe
        6⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54358.exe
        7⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9148.exe
        7⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        7⤵
        
        PID:16528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55820.exe
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36320.exe
        6⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55738.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7741.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
        6⤵
        
        PID:14120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7034.exe
        6⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13231.exe
        5⤵
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55895.exe
        5⤵
        
        PID:12232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32340.exe
        5⤵
        
        PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62884.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22009.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18127.exe
        7⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33427.exe
        7⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11836.exe
        7⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
        7⤵
        
        PID:17436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34934.exe
        6⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 488
        7⤵
        Program crash
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5380.exe
        6⤵
        
        PID:11664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42762.exe
        6⤵
        
        PID:10788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36092.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14264.exe
        6⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27471.exe
        6⤵
        
        PID:12176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5497.exe
        6⤵
        
        PID:16256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23128.exe
        5⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54079.exe
        5⤵
        
        PID:12880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
        5⤵
        
        PID:15620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55485.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64702.exe
        5⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40.exe
        6⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8953.exe
        6⤵
        
        PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44744.exe
        5⤵
        
        PID:7764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
        5⤵
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30285.exe
        5⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exe
        5⤵
        
        PID:17512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6462.exe
      4⤵
      PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        5⤵
        
        PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        5⤵
        
        PID:12600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
        5⤵
        
        PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
      4⤵
      PID:7564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12896.exe
      4⤵
      PID:11920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19698.exe
      4⤵
      PID:2244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37207.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34593.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        6⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14349.exe
        7⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1768.exe
        8⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        8⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
        8⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44936.exe
        7⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61508.exe
        8⤵
        
        PID:16948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13438.exe
        7⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29709.exe
        7⤵
        
        PID:15616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        7⤵
        
        PID:10780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47333.exe
        6⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        7⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        7⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
        7⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15534.exe
        6⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5847.exe
        6⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
        6⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56928.exe
        5⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
        6⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exe
        7⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36412.exe
        7⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45935.exe
        7⤵
        
        PID:15128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52386.exe
        7⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17262.exe
        6⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62744.exe
        6⤵
        
        PID:12864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11929.exe
        6⤵
        
        PID:17164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11675.exe
        5⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1768.exe
        6⤵
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59306.exe
        6⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21399.exe
        5⤵
        
        PID:7584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39476.exe
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        5⤵
        
        PID:17236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8391.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        5⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5112.exe
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        7⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        7⤵
        
        PID:12256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exe
        7⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41021.exe
        6⤵
        
        PID:9652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
        6⤵
        
        PID:13576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22290.exe
        6⤵
        
        PID:15380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40124.exe
        5⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26465.exe
        6⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        6⤵
        
        PID:13292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9721.exe
        6⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57911.exe
        5⤵
        
        PID:8356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62744.exe
        5⤵
        
        PID:12888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53818.exe
        5⤵
        
        PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14555.exe
      4⤵
      PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16654.exe
        5⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18127.exe
        6⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33427.exe
        6⤵
        
        PID:9128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51800.exe
        6⤵
        
        PID:15312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        6⤵
        
        PID:18396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25925.exe
        5⤵
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
        5⤵
        
        PID:14208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
        5⤵
        
        PID:10872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17540.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1768.exe
        5⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        5⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exe
        5⤵
        
        PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12734.exe
      4⤵
      PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39359.exe
      4⤵
      PID:12244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34545.exe
      4⤵
      PID:3908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11256.exe
        5⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14349.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60473.exe
        7⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21582.exe
        8⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17404.exe
        8⤵
        
        PID:14632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32881.exe
        8⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe
        7⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5950.exe
        7⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
        7⤵
        
        PID:10932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe
        6⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6318.exe
        6⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28749.exe
        6⤵
        
        PID:14420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
        6⤵
        
        PID:17444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22060.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64233.exe
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43143.exe
        6⤵
        
        PID:12912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49514.exe
        6⤵
        
        PID:17200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15534.exe
        5⤵
        
        PID:7512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48141.exe
        5⤵
        
        PID:11524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13930.exe
        5⤵
        
        PID:10800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41852.exe
      4⤵
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        5⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29494.exe
        6⤵
        
        PID:14460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26739.exe
        6⤵
        
        PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4107.exe
        5⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56382.exe
        6⤵
        
        PID:12200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-977.exe
        6⤵
        
        PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49781.exe
        5⤵
        
        PID:13032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45458.exe
        5⤵
        
        PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
      4⤵
      PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        5⤵
        
        PID:12068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26057.exe
        5⤵
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
      4⤵
      PID:7628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55319.exe
      4⤵
      PID:12044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11519.exe
      4⤵
      PID:16200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
      4⤵
      PID:3176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11764.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63830.exe
      4⤵
      PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16462.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55068.exe
        6⤵
        
        PID:14444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        6⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59744.exe
        5⤵
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15166.exe
        5⤵
        
        PID:12056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29121.exe
        5⤵
        
        PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40124.exe
      4⤵
      PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12157.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        5⤵
        
        PID:12552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
        5⤵
        
        PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6895.exe
      4⤵
      PID:9600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
      4⤵
      PID:13924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47370.exe
      4⤵
      PID:17092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38564.exe
    3⤵
    PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51542.exe
      4⤵
      PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        5⤵
        
        PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        5⤵
        
        PID:14192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29147.exe
        5⤵
        
        PID:16892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23895.exe
      4⤵
      PID:8380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
      4⤵
      PID:14096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18073.exe
      4⤵
      PID:10772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
    3⤵
    PID:7016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26465.exe
      4⤵
      PID:9440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55068.exe
      4⤵
      PID:14496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe
      4⤵
      PID:16148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53062.exe
    3⤵
    PID:10220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38755.exe
    3⤵
    PID:14328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59682.exe
    3⤵
    PID:16912
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49975.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49975.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39393.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18366.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14525.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
        6⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20302.exe
        7⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5847.exe
        8⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46599.exe
        8⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55467.exe
        8⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5556.exe
        7⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33513.exe
        8⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48171.exe
        8⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16531.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35011.exe
        7⤵
        
        PID:17696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55496.exe
        6⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        7⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29494.exe
        7⤵
        
        PID:14476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3194.exe
        7⤵
        
        PID:16240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60237.exe
        6⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24198.exe
        6⤵
        
        PID:13196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        6⤵
        
        PID:17020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
        6⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31878.exe
        6⤵
        
        PID:13044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20946.exe
        6⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39564.exe
        5⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36678.exe
        6⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23071.exe
        6⤵
        
        PID:15340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39618.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37565.exe
        5⤵
        
        PID:11032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54348.exe
        5⤵
        
        PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16174.exe
      4⤵
      PID:880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exe
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11005.exe
        6⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        6⤵
        
        PID:13932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15113.exe
        6⤵
        
        PID:17284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1799.exe
        5⤵
        
        PID:7600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        5⤵
        
        PID:10236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6345.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50509.exe
      4⤵
      PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        5⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29494.exe
        5⤵
        
        PID:14432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26355.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34830.exe
      4⤵
      PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
      4⤵
      PID:11384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7451.exe
      4⤵
      PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32023.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5480.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64790.exe
        5⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9632.exe
        6⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        7⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        7⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33649.exe
        7⤵
        
        PID:16548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
        6⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58437.exe
        6⤵
        
        PID:13460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30849.exe
        6⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23311.exe
        5⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        6⤵
        
        PID:12496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exe
        6⤵
        
        PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        5⤵
        
        PID:11036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43799.exe
        5⤵
        
        PID:14960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54195.exe
        5⤵
        
        PID:15808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36092.exe
      4⤵
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39913.exe
        5⤵
        
        PID:7736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe
        6⤵
        
        PID:13540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26074.exe
        6⤵
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61109.exe
        5⤵
        
        PID:10496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5971.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52386.exe
        5⤵
        
        PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23128.exe
      4⤵
      PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        5⤵
        
        PID:13988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25882.exe
        5⤵
        
        PID:16976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54079.exe
      4⤵
      PID:12872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
      4⤵
      PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14712.exe
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        5⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        6⤵
        
        PID:8840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        6⤵
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
        6⤵
        
        PID:10852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62432.exe
        5⤵
        
        PID:8912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44758.exe
        6⤵
        
        PID:13944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
        6⤵
        
        PID:17104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50247.exe
        5⤵
        
        PID:12436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
        5⤵
        
        PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6487.exe
      4⤵
      PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        5⤵
        
        PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        5⤵
        
        PID:11500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
        5⤵
        
        PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
      4⤵
      PID:11340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29550.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
      4⤵
      PID:1276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
    3⤵
    PID:736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40982.exe
      4⤵
      PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57742.exe
        5⤵
        
        PID:13488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20106.exe
        5⤵
        
        PID:16964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61109.exe
      4⤵
      PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5971.exe
      4⤵
      PID:14300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52386.exe
      4⤵
      PID:4288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30214.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44455.exe
    3⤵
    PID:11312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37801.exe
    3⤵
    PID:4792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
    3⤵
    PID:3648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24053.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24053.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55366.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        5⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18127.exe
        6⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43305.exe
        7⤵
        
        PID:13740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9546.exe
        7⤵
        
        PID:16688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33427.exe
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44976.exe
        6⤵
        
        PID:15528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe
        6⤵
        
        PID:10764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34934.exe
        5⤵
        
        PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5380.exe
        5⤵
        
        PID:11672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22662.exe
        5⤵
        
        PID:16064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36322.exe
        5⤵
        
        PID:14900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62901.exe
      4⤵
      PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49150.exe
        5⤵
        
        PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65432.exe
        5⤵
        
        PID:11468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        5⤵
        
        PID:15520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        5⤵
        
        PID:7120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44364.exe
      4⤵
      PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36620.exe
        5⤵
        
        PID:960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44384.exe
      4⤵
      PID:11516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36310.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
      4⤵
      PID:6824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10119.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
      4⤵
      PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30598.exe
        5⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48489.exe
        6⤵
        
        PID:11424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50178.exe
        6⤵
        
        PID:16512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49184.exe
        5⤵
        
        PID:11136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        5⤵
        
        PID:15084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31347.exe
        5⤵
        
        PID:16556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1708.exe
      4⤵
      PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        5⤵
        
        PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
      4⤵
      PID:10952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51333.exe
      4⤵
      PID:14376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13465.exe
      4⤵
      PID:17524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
    3⤵
    PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe
      4⤵
      PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
        5⤵
        
        PID:11016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57389.exe
        5⤵
        
        PID:14856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
      4⤵
      PID:11708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42578.exe
      4⤵
      PID:10816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63877.exe
    3⤵
    PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48297.exe
      4⤵
      PID:12152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15969.exe
      4⤵
      PID:4428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63383.exe
    3⤵
    PID:10488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11908.exe
    3⤵
    PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54644.exe
    3⤵
    PID:5452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42959.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42959.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44541.exe
    3⤵
    PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1085.exe
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        5⤵
        
        PID:14008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56043.exe
        5⤵
        
        PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1799.exe
      4⤵
      PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42276.exe
      4⤵
      PID:11644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30657.exe
      4⤵
      PID:232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20222.exe
    3⤵
    PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2484.exe
      4⤵
      PID:10332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37772.exe
      4⤵
      PID:14060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6842.exe
      4⤵
      PID:6468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43496.exe
    3⤵
    PID:8244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
    3⤵
    PID:14216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31572.exe
    3⤵
    PID:16996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4519.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4519.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65174.exe
    3⤵
    PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53737.exe
      4⤵
      PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        5⤵
        
        PID:9368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        5⤵
        
        PID:14016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39707.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48229.exe
      4⤵
      PID:9756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61871.exe
      4⤵
      PID:13764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7034.exe
      4⤵
      PID:16932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26191.exe
    3⤵
    PID:6712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27233.exe
      4⤵
      PID:7244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
      4⤵
      PID:14024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20978.exe
      4⤵
      PID:16852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13422.exe
    3⤵
    PID:9184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58245.exe
    3⤵
    PID:5220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63714.exe
    3⤵
    PID:16540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6333.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6333.exe
  2⤵
  PID:6092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51846.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51846.exe
    3⤵
    PID:9260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
    3⤵
    PID:12960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
    3⤵
    PID:6348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60443.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60443.exe
  2⤵
  PID:7880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33503.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33503.exe
  2⤵
  PID:11376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64445.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64445.exe
  2⤵
  PID:15652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58435.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58435.exe
  2⤵
  PID:10892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7064 -ip 7064
1⤵
PID:12416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 14128 -ip 14128
1⤵
PID:15952

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 17256 -ip 17256
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 7328 -ip 7328
1⤵
PID:17584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 10872 -ip 10872
1⤵
PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10019.exe

Filesize
468KB

MD5
b620119cab3ac6d35c7689247179446f

SHA1
0b24696d6ae75c09b5b2aea440ceb5e07f8e8a8d

SHA256
e212026e5ec8376c320bfb7f32b2e7a5675c5c31a53e6a4278da9dba3ba4767a

SHA512
4ba61d746a0d04b91499db3eca487c77422bc9fc3243e5d1388e46dc72be698d89aeaff838d66c26ae8ef1c8576906da0d957cb7e35507f2a88e9f4274ab0961

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe

Filesize
468KB

MD5
a370e97ca2d4089b1a27fb0b56175b86

SHA1
01632d798186eed5432444b3c1d5de7250b20955

SHA256
e9853c2bd68ce2c1b249e1cf601b11908d05e49608a4ab0026ff325932b516c8

SHA512
707bf66e2b9c9f2a67681026c852e2013bdb746a64e1d26558db264814653196e9c47ecb09b0f58061a7e61323fedb09978029cc8b6e9667ad779f10adee6118

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe

Filesize
468KB

MD5
a653f83132a4a55d6c65f4fc061e3313

SHA1
982a65013f81d628074c57958254e387db54b3a2

SHA256
1ed234cf143c1bd36e092a55b14bb80a45c55e8f7c46bf8bfed993ecdc4067eb

SHA512
4e566c86cc143b8a9f318ed483368db2b5a91751c06b8b4e8c3d91aefca53e32c4212d6304276e460330d0aaa5a72e0254b562d6b29c61f5fdf6c3d0e04d2cd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe

Filesize
468KB

MD5
04d3137c25012479e1d631d3ab937742

SHA1
2bfffd5ee654484529f0531be7509949bc9c4d4f

SHA256
2521467195c2a9261431bcdf6a7c924f6dc22a91739ff849e791a527931cad37

SHA512
5a5fcb3ac4deeac44ad43a64f80d59749dde3aae210b4c5282675cbfc463d836fffd97b4c01004c0ad12e25de7ac854f70f53dbb0c3c2d133db265c37f8a9a55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12043.exe

Filesize
468KB

MD5
f3539cbbacfb3c8eed821929e62bb553

SHA1
770054984d39618d751410bfdd554d771bb20cec

SHA256
1535889887125b31e37d8433eb836319b6d1dddacbdeaabbacd4b475ca0996ef

SHA512
b0d2195c02db4084584f9f23862d9a4fa556c902c78eefdc25450d7caddd8246b13be60796b26d9cb869a41092e7e53506c5b6e474a3f9c9656d2d4d7c924d89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16150.exe

Filesize
468KB

MD5
fd1b50e4342c01e3b1290de7f02f625d

SHA1
2b5bd8f8ef673084f4286a5ec68458e75d721a05

SHA256
63591eb5a62d5b2a154e1127baf83cd5a7a1e7e2d20a666ff1002f0ca0aac988

SHA512
524642560a658f1874047efc338bfe5d959f54b2391a74fac70c842ef3dad451ea9b76308263220688b80c006a822a98a3c1dfb05b24a3c1259c877b085a1c34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18366.exe

Filesize
468KB

MD5
5a760eb2b4bb5450cd231751c6f52751

SHA1
d56926314b461f377dc54e80b07557504bacd8cb

SHA256
b88bac5295bd93b5845bfe9639d3bd53d5d04054506df0d5c89334c1a081b366

SHA512
82e0b23a0d1d8a9bbd850b437e31e79b3f3b4bf7e2117401d5c278da599aa62a94288cd31ab0d93dcc5f19602acc4de0408f784a15c63e1b9389e2475323160a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1844.exe

Filesize
468KB

MD5
5b8c6fd54b31a2cbb349505784362b59

SHA1
b47df8dd338d99e56407dd1b7a5845386077deb3

SHA256
e676ae667ac6dff90cb18ebfad145b7833e304c9762831ace25440df0d43d5c3

SHA512
4f22747d6d664d5c77366e5162e36f969daceec71884b60909da364966484aaf6aae7f527e2f7c2d1f22439377183339aec52f5111cd53355adfd2660b217db2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20788.exe

Filesize
468KB

MD5
00fd0283952a92e29606f9e6ecd65a60

SHA1
e070971a65a0e63eaada0596cdca6691f068b5e3

SHA256
edf452ca10b99b54d8dea5043d8bffbdbe8561040335540a7cbd6940ccc4e8dc

SHA512
41de17d95fe1c0cd6f84870ffce7ae0c4966a4e46672558e6f2391fe98b2c33d2843b9ae233089dd52e670a7b264827241d2f57447de00716740283e3aa26377

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24053.exe

Filesize
468KB

MD5
5179144431c3a3b830b6ef040c4c5cc0

SHA1
2f99b4975cdc27fd30e4f9c0cadd18c16ce4d8cf

SHA256
f9633efc949c720635ec8892ee86abcb64656043640da5f13b88148f5b4f209a

SHA512
9e5ad05e0d6953825c64f94b955e69455b6233247c97bc9b0fa053ef68acbf15c0bca880bf6ff471124a0bdd4d3b3d22c039801b306ab9d106069198c8d150b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2796.exe

Filesize
468KB

MD5
f7df6a2f7fb681c018e20d710337b8b2

SHA1
c12df04ec7d32823732274d31441dfb275c68750

SHA256
944191a5265f6a09fa79a0f08be9644942f3e9dde28c6382ca6a6a664cf4d897

SHA512
b46212c9689d16693c1c164fe33ab71c5d47de619b225319925830f0cb2218b52a53925a43b7020eda17c609a43e5a3d748fa7218e08e2bcc3a49786e43b98da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe

Filesize
468KB

MD5
f4c2e8aefcdb16c968e3ee45cced0567

SHA1
bfec1994c6ae123f22a0bd25e6979f8902ac8928

SHA256
7ed28bc8cea66b9a458192a9ce9961f9119b70b289ce96074b469c5ad417c083

SHA512
5992840e3cdc062913c47feee35acfc53881844c4e18de5fdfec20db02035238a1bfcc18829b870efb7e5532f93dcd57e7c921e09669d79f43e46d0db8edcf1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32023.exe

Filesize
468KB

MD5
f8736273d5f75080ed5ced1653c0030c

SHA1
a5ec91ea9667d57dd0979939d1f15103cd63cc39

SHA256
6beaf8eadba64970ff0bc4e8b8804093c2a674a2f43a44fc46236f4412b0bb46

SHA512
4a79def1d46772332a0d782b412fd77127ce61e19d871a6e5a710a63761ee83f877314d78a46100ec338828d9c16cb77b64737cc43ad6776e264e8e0c6ed14ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32569.exe

Filesize
468KB

MD5
d318c216765e2b0ee3c169b66ada28cc

SHA1
c5642cce7cd834b82926dca997583bdef6a20357

SHA256
066ce10eea9130fa3bc9aa8cc39e4bd9f85474d17c506f8da6eeab8b0832e0cd

SHA512
1677ae81a17bf17b880f9f83cb4164de1f42e3d115c9ff7d75adb1e81cf4f0a7c47dc8fb486eaa09983c9663ddda00d6f4ec93dd662640ad85b7d5c4617fdcdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33441.exe

Filesize
468KB

MD5
a612395661f411aec44e944d6190adc6

SHA1
867ead2af7ef4066a5b2e92b520bff903abe657f

SHA256
86fd66be639e8131f2095b0873b9cea32d587f4c8254e155e3d2aa03fe62e8f3

SHA512
65f8b83c8453bee92bb460e7882b8a8a4873f72bc53d2395cc0bd68bf18bd2e0e7e3f68d9df8d5293c0b263e3e06550c2765f99cfa9030c18b7de4531df7602c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34593.exe

Filesize
468KB

MD5
8e4f6aa5b84236adab74cc65075c292c

SHA1
35c6954109c5eb8374eede0c8720ca153ac0acc0

SHA256
5cf6de160088cfc2e131b09fb88be097a280a893bf84c43db56197125d984aed

SHA512
d3b34379c1450d9686ac6d0e6b19b707711e4e377b6d48c9fb70bbe914ba8db514cc044a9a26df4bae859ec1be408a9c0d3e3bcb672d73cbd5891dfe24c40673

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe

Filesize
468KB

MD5
69ba56f01044be0c3194826c0098e564

SHA1
e695ad0bad74e73892c4d0dec53c364ae6d35521

SHA256
166b81ced1ccefebed04372dfdcbd3552d3668d85fa78f5b717d4cf62e4598d7

SHA512
7bbd8e471c0c5b4b216be18d1041b2f38a483eec4ee8d602e80998c62187cc4b06bbd18c98a20e2756369f6af465fc06ac95b749a6a4ac9a60d763191292205f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36239.exe

Filesize
468KB

MD5
68a823d78e5ae70330b1ac6482f7d380

SHA1
3ed90444db8607a4222daefce610df57049c813a

SHA256
d65ae1e2c65dde2f83b19ac031ace498ad7470735a0bdc204097329f654596a1

SHA512
8cace4ec72e8a9ad57ee41f2c8ffd8992fbd93306a0a0c4f966a646b8375567c24301eabd9a5814dd47893e39b8094e1d37f452aa2a12db32c076ab40aedcbec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37207.exe

Filesize
468KB

MD5
a587191b5bba11ad7b1317265e49b558

SHA1
5c659dd1124f5f5b86d3674798a8465eb253fa67

SHA256
bfdf4d3806ecc93ac3f5bd31e987235292f30a18ccd5b8c851811669b6a3bba8

SHA512
1038c9ddd87e8acf15303e47703cd9f9bd5de0a3fb3ba7bbc37a0b309e1376be858e986bfaf9b571c410d030eb988ce7f6aa4b2b2f11070415ce882f8d437f9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe

Filesize
468KB

MD5
0e6e74501889d09daaf2cc9ea3152496

SHA1
452f4f50255a32a30d818a447cd1042035925682

SHA256
f2a57ebcc43a95e907ee14b8e30986298b75e06feceb86dba86b928092eed68c

SHA512
61ec307317cffd213893e4d40705991bc11243e235ee205b82b9bc64e070821d5407472724cd64fb40d700a5fbf743e950400a72e9af03e1822affeba2ddc6a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39393.exe

Filesize
468KB

MD5
2eb0eca146187c9caf7effb10555ed90

SHA1
22735bd4d8ec58a6c5aace11e4c3eb809e4334ea

SHA256
76f871ad435f79f167358d57ac5dcde0b1a7d996fbaf4278229675c68921f118

SHA512
ac2dcf5b820610764fc811503af0c8d0d7ad04465082fffda8a5472f6c428af718551b87386b938aa01f667c46d70af1ddc2b19c468f43610e87c4994413fbfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42959.exe

Filesize
468KB

MD5
9f76ba24c0dc1c18b6187956bc55ed56

SHA1
8445ee85a8cdc2047a7db1568f997fe0bbe420d4

SHA256
99333130b2529285c6d237062745612a53f722a8c06ee081b3b362c78ba48f0e

SHA512
bb47682693423cebef234431d6b885ef73bf3aef7064f7e7660ae9dc88d8f0e71d67f7719965c82734ddc2e4d040b63168b8efb9cd044cd2d0ffdfc9c3de2658

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48821.exe

Filesize
468KB

MD5
97b80a8eb80da26387c3d938d3c8fa8a

SHA1
22f7d188737787fa2e7df160eed1894a7151bbdb

SHA256
dce3452ee4782f2ea135d6cb9eac1d37145d302eb4c4db609819f1d385041523

SHA512
67c5846e79bc32bed9da9b167b5de3f40cafd70d8f36e0a719cd6e5199bcf0b188a1fbe89499ca6e6bdf2c0970519cf88b64e887e34bbfca3e88bcced46eac38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe

Filesize
468KB

MD5
2f63dced5eacd9154ba7d6f8fb67c5b0

SHA1
992d0fbb07e90a43f45bccd6200156ec1128af9e

SHA256
99fb8457be9c3a22b76dae55522c5276cd5a9a0b6d175d2c5c8459e0b71fe10d

SHA512
47bdcd6bf35234c80409f93f5c6d6c1c0b50f210baaa17c3e840f304b6d92f7a34a7ff5c55582647fb4f9af0482ec07c21eae094fb021017bc9fc42a4f18e567

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49975.exe

Filesize
468KB

MD5
128d9db0edf5e4075ad753286dd9824f

SHA1
f38310640119f5e35251a7c836480ea60be4d961

SHA256
cf9052024d8628e4e17cd723ff31371fa4a23c2cd2a77bc9db0451cb2d1daaf4

SHA512
838f08f3b295d94c47ecbc3412e680d4f3ded4ab35d2a4cea48d024122db38eaf8b5a628366d38ea5fac5fc7afd10b537f4fd43ca7d1a136acf2146728354d8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51624.exe

Filesize
468KB

MD5
dc6ac18a6f77cb2d054cc68e2c0f8bc1

SHA1
41ddb429acaaf49197d82cc6033f1c69052851c6

SHA256
3430f79c1c7eb122f568f4d637caf2f23281235ade96f72d99e8e3aeec4dd322

SHA512
f554b599414be00c753cb2ed4a0fc49d3033399d1fdb9b7d2cbd6913d03b81c09485ac69cf1cced48b1c9e606442bfd8f8887d4ba46138a12f0c0c03991ededb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51889.exe

Filesize
468KB

MD5
ebf632ceaaa2f810c94f6ff43a25b110

SHA1
e0c9e0d55a402a28f54b5bc4113979b808a1c8a2

SHA256
1a3e15a46938eebc0ddc6587c0daf48ee1a3203a723edb536b5bf0cc53c0ead6

SHA512
29cc2fd05e12c005861365319429fe12d41190cb0ad12e25104459f7f6ae80a76f8dad75584391bf343629b81e5f84363f1e38c85cdb1b9b257cf5cd694a03a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe

Filesize
468KB

MD5
38a70afe4b480ca871885a3386983fdf

SHA1
f5cce2de4493abe9fa567c7e5ed6dc56a3f773d4

SHA256
95e9cf5f5b0f878cd478ece37b913e6f52c59e8cf7bd56111b411936afd09328

SHA512
ffc24a76bea8a4d97e9b4fd66254240fce91afaeb7ae50378697df07047eae4fbb4b64b5ed6d3d33f69703bdf7e78bc980e50e7fcebdeb1026ac3d802f779cff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5373.exe

Filesize
468KB

MD5
5c1cd2a2e8d67fc2a219e720005d1d10

SHA1
2e5435ec8f7b9e8f867ab499040528c8d0b0cb80

SHA256
96496d6d91761ca911d952a45692dd9c1c2583a3bc9e0acb6ea1ac91d41343a7

SHA512
153b4fc2054a82baf5e3d59eb4f4b554dfbd3f671dd1126b824626d7d89f6fba91890dc19ac673a1c1c42f00b8f536892daf9b26a7ec4b85072f4bd7ec9a4837

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55046.exe

Filesize
468KB

MD5
9b3922dd0af88e80764b86ddb7044ea3

SHA1
b981f9d812bc180085b88ba3cef0e0ea89cf70d7

SHA256
5ea495596ccd66f475be74dd9751b7ce7ebd554cf837c0afb8343fa311e8c898

SHA512
de1410091bf7e8b1945b79d511889bdca7cdf04d7103fca3038ac80c92cbbdb7a22983772f8f349d3b0b1c485de573cff1c4f00cfb17ebd7baef0cba62db5034

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57174.exe

Filesize
468KB

MD5
adf546efb81557bba21a1596c3633797

SHA1
9b276761aee200543e64a217c6b6d3336bb935d6

SHA256
e9a75192ef60ff4a29071118aa84fd593487e372f0072bd507b222e6fdb26bb3

SHA512
64ec2056f9e679b6c6901ec48ffffe7f42834193f21a293543e94833bb998c3ddf3f3b219fe2a2f334f21c7551be29e0744c00a83d2ff4820e49a874043edb7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57670.exe

Filesize
468KB

MD5
c419a6daf839f19af4352154ec760b88

SHA1
03d74d6b09636ff2771a6ed7b4f7ddad7aefc333

SHA256
d5f2b77778752662eca109935ec73152d7bc3c71ec00b86fee949f4d42bc7d8a

SHA512
ee57a2b396d87b4ca8067908de2447b52f565e7e476aff55da33f6e573a68187a7acd2ec9dcf3c08ed4957a45525a76033d14cbbd067f3ccef9f31337b821366

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6175.exe

Filesize
468KB

MD5
ac3bffb04d3edc6569572cda96a4dadd

SHA1
9a66e51584632d54821db8eb400993dd798fe8dc

SHA256
dfca49eb9fc8d05c7ca2df7ba93216fc9f755fb4439199bbd8cd99ed8112c511

SHA512
e24e40d5714a5892cfd8f585924957d8b2e7f29f73613186088a293e5a6c9c287bd7e2c89cf67d408b610deae74e9bccb8b0b2be77fb34810aaa99736af52ca1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64037.exe

Filesize
468KB

MD5
0746d86d16e940add47fbcac233fa3a1

SHA1
c07c97f73e80196ea39eefe00045ef1e8eeee409

SHA256
8a518944530b7ba23d0a1ffc4e6875e053b7c8b83ebf092897b327edae5edbc6

SHA512
172e9c26cb39c41bd2960bb780c8d16f5e6cf667130cc3263f87dbcf64d7fc1bc3c3f84ad69b523df781b7df2b3ed8e4623f2e468065932dcf0fe0292f6b4d15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6549.exe

Filesize
468KB

MD5
d42c911ca57ad4398b29ab423904fb99

SHA1
6acb7bc212e9b180ffd55fa35a600139ddb92a54

SHA256
609cba68f70049621917cf9fb7ee037d15a5dd81c57d81f23d84feb0ad11cd9f

SHA512
7fc141f82a30b043c758f5450de2983f95e6f9c28dd146febe6a0db4b45d2d3eb6e4b46331a5c62dc124ab15d72e760101c6d914b1c1a101321deccc7f62c009

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe

Filesize
468KB

MD5
fd0da92546a08c5949aa763b2c09b2d5

SHA1
6a31f7e50eb9b2dbb75f722d1286b49772d00a4d

SHA256
e7e3eafcea7e888e6eae84fc2e65e2fb4ee18754b930c348678558397c0bb166

SHA512
d2eef23244957d792e6596da1dc2f72354ee4c7684bc7a4d4a29fe28fb54f09c5082d6d1d5e7c4adf902b984609348bfb218743a287346bb6a8d2bf020569ceb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8289.exe

Filesize
468KB

MD5
b827ed9d0754e55dc4a793d82195c278

SHA1
bdfec2ad6c74681f588da0cd8a600a8a357334ac

SHA256
3f1367accf8501de89861bf4dc223099866fe5e96b2c4d373743a63a7f927f95

SHA512
e67ad364c4fac94c1a2888646a10f6223ea1a3ef98f8620c0b2fdc8e628e94c60136d0afdb496903cd7bcc8f6a0af64bfda78a378e1c8096b7d1b24ab9db51e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9632.exe

Filesize
468KB

MD5
317c28c0e5e5f4126535c9058f8ad4f0

SHA1
5c03de25408e8a7046fd8d38f44520505dbecbc2

SHA256
9519dcc19b23f9e5a9424ff92e63696f04379cefd089c52abde76a59db5a278b

SHA512
c5aecd5e53abf28720ab1231b215fe4199d31a393c2d7aca4c3a88e4b4e9d24fab59941e4c9530a4e38b81a105cb8d6fefcc0ef35686b6480e2c6c33149bc71b

Download Submit
memory/60-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/392-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/444-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/624-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/636-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/680-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/740-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/744-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/748-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/880-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1020-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1124-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1160-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1464-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1484-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1824-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1936-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2052-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2208-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2248-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2252-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2260-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2300-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2340-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2540-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2632-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2684-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2728-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-493-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2852-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3004-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3156-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3200-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3244-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3252-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3308-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3416-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3444-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3456-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3468-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3476-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3568-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3616-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3640-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3644-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3708-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3760-213-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3792-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3924-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3928-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3936-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4140-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4264-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4316-471-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4320-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4368-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4512-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4580-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4584-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4592-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4680-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4788-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4820-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4824-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4876-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4892-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4936-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4948-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4960-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4972-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4992-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5020-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5100-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5192-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5196-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5240-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5252-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5272-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5308-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5364-533-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5396-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5432-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5496-568-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5512-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15528-2513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15720-2509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15756-2573-0x00007FF82EC30000-0x00007FF82EE25000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads