fbbadd55782dd9a34b87650a3fcc64411b7ccdb6d8e3b6ae175790818a79cb51

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbbadd55782dd9a34b87650a3fcc64411b7ccdb6d8e3b6ae175790818a79cb51.exe
Size

468KB
MD5

68732d24ea0119a51aa45276a79695f2
SHA1

86c0bdf5941b91ed4ec4d0056a081429a008ec67
SHA256

fbbadd55782dd9a34b87650a3fcc64411b7ccdb6d8e3b6ae175790818a79cb51
SHA512

51730ce3a6a3e21e5a3f01cbbfb2d7908864ccc345d94b129789b74af6bd62809c8b21c856853644f60dcfcf34f199551401752656e9e7dfe7fff5da0935d1c5
SSDEEP

3072:1WP5ogMFjb8y2bYfUz54ff8jEC2j4mCCgmHebVzVS3K3UMuzmelD:1WRoXYy2wU14ffANHjS3I1uzm

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4760	Unicorn-47313.exe
1288	Unicorn-51073.exe
2240	Unicorn-31207.exe
4904	Unicorn-8046.exe
2152	Unicorn-14176.exe
1672	Unicorn-46657.exe
2488	Unicorn-26791.exe
4660	Unicorn-352.exe
8	Unicorn-33409.exe
1296	Unicorn-29879.exe
652	Unicorn-17684.exe
376	Unicorn-32833.exe
712	Unicorn-49169.exe
2056	Unicorn-10174.exe
4436	Unicorn-45640.exe
1788	Unicorn-33809.exe
2028	Unicorn-14135.exe
1072	Unicorn-2672.exe
3700	Unicorn-2023.exe
4020	Unicorn-21889.exe
3144	Unicorn-21889.exe
976	Unicorn-2023.exe
3792	Unicorn-38225.exe
4736	Unicorn-21889.exe
828	Unicorn-5095.exe
4804	Unicorn-64767.exe
2880	Unicorn-51032.exe
2540	Unicorn-61967.exe
4480	Unicorn-64767.exe
1584	Unicorn-33041.exe
3016	Unicorn-29511.exe
5000	Unicorn-49377.exe
3020	Unicorn-27102.exe
3092	Unicorn-36644.exe
1080	Unicorn-7117.exe
468	Unicorn-19540.exe
4368	Unicorn-59582.exe
2160	Unicorn-39908.exe
2568	Unicorn-26334.exe
1616	Unicorn-52684.exe
1176	Unicorn-58814.exe
2148	Unicorn-59006.exe
3716	Unicorn-59006.exe
1768	Unicorn-9805.exe
4188	Unicorn-33547.exe
2352	Unicorn-41902.exe
2692	Unicorn-9421.exe
2556	Unicorn-48423.exe
1576	Unicorn-41902.exe
3968	Unicorn-8388.exe
4936	Unicorn-8388.exe
2960	Unicorn-22123.exe
5108	Unicorn-8087.exe
2576	Unicorn-9421.exe
4308	Unicorn-41252.exe
1012	Unicorn-27989.exe
4312	Unicorn-22123.exe
1564	Unicorn-47308.exe
4420	Unicorn-3469.exe
4408	Unicorn-52862.exe
1868	Unicorn-52862.exe
3824	Unicorn-3661.exe
4424	Unicorn-52478.exe
1712	Unicorn-35685.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
9860	6172	WerFault.exe	286
14376	13916	WerFault.exe	677
17296	15684	Process not Found	751
18336	17664	Process not Found	934
12812	18000	Process not Found	956
18352	16828	Process not Found	897

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37793.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48289.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
14996	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16572	dwm.exe
Token: SeChangeNotifyPrivilege	16572	dwm.exe
Token: 33	16572	dwm.exe
Token: SeIncBasePriorityPrivilege	16572	dwm.exe
Token: SeShutdownPrivilege	16572	dwm.exe
Token: SeCreatePagefilePrivilege	16572	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3232	fbbadd55782dd9a34b87650a3fcc64411b7ccdb6d8e3b6ae175790818a79cb51.exe
4760	Unicorn-47313.exe
2240	Unicorn-31207.exe
1288	Unicorn-51073.exe
2152	Unicorn-14176.exe
4904	Unicorn-8046.exe
2488	Unicorn-26791.exe
1672	Unicorn-46657.exe
4660	Unicorn-352.exe
8	Unicorn-33409.exe
1296	Unicorn-29879.exe
376	Unicorn-32833.exe
652	Unicorn-17684.exe
2056	Unicorn-10174.exe
4436	Unicorn-45640.exe
712	Unicorn-49169.exe
1788	Unicorn-33809.exe
2028	Unicorn-14135.exe
1072	Unicorn-2672.exe
3700	Unicorn-2023.exe
4020	Unicorn-21889.exe
4480	Unicorn-64767.exe
3144	Unicorn-21889.exe
3792	Unicorn-38225.exe
976	Unicorn-2023.exe
828	Unicorn-5095.exe
2880	Unicorn-51032.exe
2540	Unicorn-61967.exe
4804	Unicorn-64767.exe
4736	Unicorn-21889.exe
3016	Unicorn-29511.exe
1584	Unicorn-33041.exe
5000	Unicorn-49377.exe
3020	Unicorn-27102.exe
3092	Unicorn-36644.exe
1080	Unicorn-7117.exe
468	Unicorn-19540.exe
4368	Unicorn-59582.exe
2160	Unicorn-39908.exe
2568	Unicorn-26334.exe
1176	Unicorn-58814.exe
1616	Unicorn-52684.exe
2148	Unicorn-59006.exe
1768	Unicorn-9805.exe
4188	Unicorn-33547.exe
3716	Unicorn-59006.exe
2692	Unicorn-9421.exe
1576	Unicorn-41902.exe
2352	Unicorn-41902.exe
3968	Unicorn-8388.exe
2556	Unicorn-48423.exe
4936	Unicorn-8388.exe
2960	Unicorn-22123.exe
4312	Unicorn-22123.exe
1012	Unicorn-27989.exe
2576	Unicorn-9421.exe
5108	Unicorn-8087.exe
4308	Unicorn-41252.exe
1564	Unicorn-47308.exe
4420	Unicorn-3469.exe
4408	Unicorn-52862.exe
1868	Unicorn-52862.exe
3824	Unicorn-3661.exe
4424	Unicorn-52478.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 4760	3232	fbbadd55782dd9a34b87650a3fcc64411b7ccdb6d8e3b6ae175790818a79cb51.exe	84
PID 3232 wrote to memory of 4760	3232	fbbadd55782dd9a34b87650a3fcc64411b7ccdb6d8e3b6ae175790818a79cb51.exe	84
PID 3232 wrote to memory of 4760	3232	fbbadd55782dd9a34b87650a3fcc64411b7ccdb6d8e3b6ae175790818a79cb51.exe	84
PID 4760 wrote to memory of 1288	4760	Unicorn-47313.exe	87
PID 4760 wrote to memory of 1288	4760	Unicorn-47313.exe	87
PID 4760 wrote to memory of 1288	4760	Unicorn-47313.exe	87
PID 3232 wrote to memory of 2240	3232	fbbadd55782dd9a34b87650a3fcc64411b7ccdb6d8e3b6ae175790818a79cb51.exe	88
PID 3232 wrote to memory of 2240	3232	fbbadd55782dd9a34b87650a3fcc64411b7ccdb6d8e3b6ae175790818a79cb51.exe	88
PID 3232 wrote to memory of 2240	3232	fbbadd55782dd9a34b87650a3fcc64411b7ccdb6d8e3b6ae175790818a79cb51.exe	88
PID 3232 wrote to memory of 4904	3232	fbbadd55782dd9a34b87650a3fcc64411b7ccdb6d8e3b6ae175790818a79cb51.exe	91
PID 3232 wrote to memory of 4904	3232	fbbadd55782dd9a34b87650a3fcc64411b7ccdb6d8e3b6ae175790818a79cb51.exe	91
PID 3232 wrote to memory of 4904	3232	fbbadd55782dd9a34b87650a3fcc64411b7ccdb6d8e3b6ae175790818a79cb51.exe	91
PID 2240 wrote to memory of 2152	2240	Unicorn-31207.exe	92
PID 2240 wrote to memory of 2152	2240	Unicorn-31207.exe	92
PID 2240 wrote to memory of 2152	2240	Unicorn-31207.exe	92
PID 1288 wrote to memory of 1672	1288	Unicorn-51073.exe	93
PID 1288 wrote to memory of 1672	1288	Unicorn-51073.exe	93
PID 1288 wrote to memory of 1672	1288	Unicorn-51073.exe	93
PID 4760 wrote to memory of 2488	4760	Unicorn-47313.exe	94
PID 4760 wrote to memory of 2488	4760	Unicorn-47313.exe	94
PID 4760 wrote to memory of 2488	4760	Unicorn-47313.exe	94
PID 2152 wrote to memory of 4660	2152	Unicorn-14176.exe	96
PID 2152 wrote to memory of 4660	2152	Unicorn-14176.exe	96
PID 2152 wrote to memory of 4660	2152	Unicorn-14176.exe	96
PID 4904 wrote to memory of 8	4904	Unicorn-8046.exe	98
PID 4904 wrote to memory of 8	4904	Unicorn-8046.exe	98
PID 4904 wrote to memory of 8	4904	Unicorn-8046.exe	98
PID 2240 wrote to memory of 1296	2240	Unicorn-31207.exe	99
PID 2240 wrote to memory of 1296	2240	Unicorn-31207.exe	99
PID 2240 wrote to memory of 1296	2240	Unicorn-31207.exe	99
PID 3232 wrote to memory of 652	3232	fbbadd55782dd9a34b87650a3fcc64411b7ccdb6d8e3b6ae175790818a79cb51.exe	100
PID 3232 wrote to memory of 652	3232	fbbadd55782dd9a34b87650a3fcc64411b7ccdb6d8e3b6ae175790818a79cb51.exe	100
PID 3232 wrote to memory of 652	3232	fbbadd55782dd9a34b87650a3fcc64411b7ccdb6d8e3b6ae175790818a79cb51.exe	100
PID 2488 wrote to memory of 376	2488	Unicorn-26791.exe	101
PID 2488 wrote to memory of 376	2488	Unicorn-26791.exe	101
PID 2488 wrote to memory of 376	2488	Unicorn-26791.exe	101
PID 1672 wrote to memory of 712	1672	Unicorn-46657.exe	102
PID 1672 wrote to memory of 712	1672	Unicorn-46657.exe	102
PID 1672 wrote to memory of 712	1672	Unicorn-46657.exe	102
PID 4760 wrote to memory of 2056	4760	Unicorn-47313.exe	104
PID 4760 wrote to memory of 2056	4760	Unicorn-47313.exe	104
PID 4760 wrote to memory of 2056	4760	Unicorn-47313.exe	104
PID 1288 wrote to memory of 4436	1288	Unicorn-51073.exe	103
PID 1288 wrote to memory of 4436	1288	Unicorn-51073.exe	103
PID 1288 wrote to memory of 4436	1288	Unicorn-51073.exe	103
PID 4660 wrote to memory of 1788	4660	Unicorn-352.exe	106
PID 4660 wrote to memory of 1788	4660	Unicorn-352.exe	106
PID 4660 wrote to memory of 1788	4660	Unicorn-352.exe	106
PID 2152 wrote to memory of 2028	2152	Unicorn-14176.exe	107
PID 2152 wrote to memory of 2028	2152	Unicorn-14176.exe	107
PID 2152 wrote to memory of 2028	2152	Unicorn-14176.exe	107
PID 712 wrote to memory of 1072	712	Unicorn-49169.exe	108
PID 712 wrote to memory of 1072	712	Unicorn-49169.exe	108
PID 712 wrote to memory of 1072	712	Unicorn-49169.exe	108
PID 2488 wrote to memory of 3700	2488	Unicorn-26791.exe	109
PID 2488 wrote to memory of 3700	2488	Unicorn-26791.exe	109
PID 2488 wrote to memory of 3700	2488	Unicorn-26791.exe	109
PID 4436 wrote to memory of 4020	4436	Unicorn-45640.exe	113
PID 4436 wrote to memory of 4020	4436	Unicorn-45640.exe	113
PID 4436 wrote to memory of 4020	4436	Unicorn-45640.exe	113
PID 1296 wrote to memory of 3144	1296	Unicorn-29879.exe	110
PID 1296 wrote to memory of 3144	1296	Unicorn-29879.exe	110
PID 1296 wrote to memory of 3144	1296	Unicorn-29879.exe	110
PID 1672 wrote to memory of 976	1672	Unicorn-46657.exe	111

C:\Users\Admin\AppData\Local\Temp\fbbadd55782dd9a34b87650a3fcc64411b7ccdb6d8e3b6ae175790818a79cb51.exe
"C:\Users\Admin\AppData\Local\Temp\fbbadd55782dd9a34b87650a3fcc64411b7ccdb6d8e3b6ae175790818a79cb51.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51073.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46657.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49169.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2672.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7117.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35950.exe
        8⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57486.exe
        9⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20068.exe
        10⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
        11⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44296.exe
        12⤵
        
        PID:17104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8555.exe
        11⤵
        
        PID:16688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33377.exe
        11⤵
        
        PID:12044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54572.exe
        10⤵
        
        PID:16052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40656.exe
        10⤵
        
        PID:12476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10363.exe
        9⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11748.exe
        9⤵
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51916.exe
        9⤵
        
        PID:14656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43383.exe
        9⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28212.exe
        8⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30113.exe
        9⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20257.exe
        10⤵
        
        PID:11532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59100.exe
        10⤵
        
        PID:17092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33947.exe
        9⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20557.exe
        9⤵
        
        PID:17672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31431.exe
        9⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50140.exe
        8⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15373.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12308.exe
        9⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7968.exe
        9⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31829.exe
        8⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49087.exe
        8⤵
        
        PID:17776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2244.exe
        7⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40190.exe
        8⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65390.exe
        9⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        10⤵
        
        PID:10840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25467.exe
        10⤵
        
        PID:16260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        9⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46133.exe
        9⤵
        
        PID:18728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30836.exe
        8⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
        8⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47477.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
        8⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        7⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        8⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        8⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58332.exe
        8⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30069.exe
        7⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13467.exe
        7⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        7⤵
        
        PID:16852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19540.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exe
        7⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        8⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        9⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
        10⤵
        
        PID:11488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8171.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:16916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        9⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14420.exe
        9⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        9⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5844.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33093.exe
        8⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10941.exe
        8⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        7⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        8⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24574.exe
        9⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe
        9⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4615.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10331.exe
        8⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47477.exe
        8⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        8⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35470.exe
        8⤵
        
        PID:13472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11156.exe
        8⤵
        
        PID:16612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44424.exe
        8⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31445.exe
        7⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33243.exe
        7⤵
        
        PID:17300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15595.exe
        6⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        7⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        8⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        9⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12116.exe
        9⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55765.exe
        8⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7403.exe
        8⤵
        
        PID:18740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        7⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        7⤵
        
        PID:16148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61105.exe
        7⤵
        
        PID:12660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        6⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
        7⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        8⤵
        
        PID:10772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        8⤵
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        8⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33947.exe
        7⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        7⤵
        
        PID:18040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35419.exe
        6⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        7⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8555.exe
        7⤵
        
        PID:15940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61013.exe
        6⤵
        
        PID:10644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2051.exe
        6⤵
        
        PID:15724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
        6⤵
        
        PID:12008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2023.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26334.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        7⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47009.exe
        8⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        9⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        9⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        9⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14217.exe
        9⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        8⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        8⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14036.exe
        8⤵
        
        PID:16908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        8⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        7⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34366.exe
        8⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        8⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63893.exe
        8⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45336.exe
        7⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13467.exe
        7⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24388.exe
        7⤵
        
        PID:16888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40583.exe
        6⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        8⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        8⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        8⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16848.exe
        8⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25735.exe
        7⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        7⤵
        
        PID:14036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49589.exe
        7⤵
        
        PID:16732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14075.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
        7⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        7⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        7⤵
        
        PID:15808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41454.exe
        6⤵
        
        PID:16816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe
        6⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46241.exe
        7⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
        8⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
        9⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        9⤵
        
        PID:15500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        8⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64005.exe
        8⤵
        
        PID:16484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36871.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20257.exe
        8⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        8⤵
        
        PID:17200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        8⤵
        
        PID:12472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
        7⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62469.exe
        7⤵
        
        PID:18140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        6⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        7⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        7⤵
        
        PID:12748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        7⤵
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40540.exe
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54956.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63256.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39630.exe
        6⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        7⤵
        
        PID:10756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33377.exe
        7⤵
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1460.exe
        6⤵
        
        PID:10560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
        6⤵
        
        PID:16380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28500.exe
        5⤵
        
        PID:8416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
        5⤵
        
        PID:13344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
        5⤵
        
        PID:17500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27310.exe
        7⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15597.exe
        8⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        9⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        10⤵
        
        PID:13508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33629.exe
        10⤵
        
        PID:17832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
        9⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49521.exe
        9⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        8⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44981.exe
        8⤵
        
        PID:17744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        7⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        8⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        8⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        8⤵
        
        PID:16704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4233.exe
        8⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24203.exe
        7⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21899.exe
        7⤵
        
        PID:16828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39431.exe
        6⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31550.exe
        7⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        8⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        8⤵
        
        PID:16424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24110.exe
        7⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        7⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23051.exe
        7⤵
        
        PID:16476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44569.exe
        7⤵
        
        PID:12684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44335.exe
        6⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
        7⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43358.exe
        8⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30180.exe
        8⤵
        
        PID:17040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        7⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25467.exe
        7⤵
        
        PID:16276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7056.exe
        7⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22429.exe
        6⤵
        
        PID:16752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59297.exe
        6⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58062.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
        8⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        9⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        9⤵
        
        PID:16116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16656.exe
        9⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        8⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        8⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exe
        8⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32750.exe
        8⤵
        
        PID:17136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
        7⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        7⤵
        
        PID:18016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
        6⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
        7⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        7⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8939.exe
        7⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46405.exe
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13467.exe
        6⤵
        
        PID:14144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28029.exe
        6⤵
        
        PID:17232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53660.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58062.exe
        6⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        7⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26030.exe
        8⤵
        
        PID:17540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4532.exe
        7⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        7⤵
        
        PID:16468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49521.exe
        7⤵
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12964.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        6⤵
        
        PID:12552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13268.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46853.exe
        5⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        6⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        6⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41996.exe
        6⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48177.exe
        6⤵
        
        PID:11600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe
        5⤵
        
        PID:10028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62469.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6285.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        5⤵
        
        PID:12212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64767.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41902.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13277.exe
        6⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20206.exe
        7⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
        8⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        8⤵
        
        PID:12744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37019.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        7⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        7⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14036.exe
        7⤵
        
        PID:16584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
        6⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        7⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        7⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        7⤵
        
        PID:16068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
        6⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        6⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24011.exe
        6⤵
        
        PID:17028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40656.exe
        6⤵
        
        PID:12484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42716.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        6⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40609.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2548.exe
        7⤵
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        7⤵
        
        PID:18624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5383.exe
        6⤵
        
        PID:9696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27627.exe
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        6⤵
        
        PID:15700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3632.exe
        6⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57240.exe
        5⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32289.exe
        6⤵
        
        PID:12300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        6⤵
        
        PID:16932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7892.exe
        5⤵
        
        PID:10672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55486.exe
        5⤵
        
        PID:15844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36191.exe
        5⤵
        
        PID:9584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48638.exe
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39630.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23998.exe
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27332.exe
        7⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35374.exe
        7⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
        6⤵
        
        PID:11152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        6⤵
        
        PID:16696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37172.exe
        5⤵
        
        PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
        5⤵
        
        PID:13056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44405.exe
        5⤵
        
        PID:17868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
        5⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8045.exe
        6⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64005.exe
        6⤵
        
        PID:16456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        5⤵
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30757.exe
        5⤵
        
        PID:16564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31572.exe
      4⤵
      PID:7724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        5⤵
        
        PID:10824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        5⤵
        
        PID:16440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
      4⤵
      PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28718.exe
        5⤵
        
        PID:17824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
      4⤵
      PID:16800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26791.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26791.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32833.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53646.exe
        6⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        7⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        8⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        8⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        7⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
        7⤵
        
        PID:15860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5844.exe
        6⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
        6⤵
        
        PID:13048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        6⤵
        
        PID:18000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52504.exe
        5⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38862.exe
        6⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
        7⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        7⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53807.exe
        7⤵
        
        PID:18548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        6⤵
        
        PID:11132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
        6⤵
        
        PID:15820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40856.exe
        6⤵
        
        PID:13028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47340.exe
        5⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26622.exe
        6⤵
        
        PID:11696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe
        6⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
        5⤵
        
        PID:12272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41454.exe
        5⤵
        
        PID:16780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2023.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9421.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
        6⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14061.exe
        7⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        8⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45246.exe
        9⤵
        
        PID:17736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe
        8⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe
        8⤵
        
        PID:17664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        7⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
        7⤵
        
        PID:13400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        7⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23367.exe
        7⤵
        
        PID:11416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10247.exe
        6⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        7⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        7⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49521.exe
        7⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63436.exe
        6⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe
        6⤵
        
        PID:13076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
        6⤵
        
        PID:19132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
        5⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5997.exe
        6⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40225.exe
        7⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        7⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        7⤵
        
        PID:18640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        7⤵
        
        PID:11752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11.exe
        6⤵
        
        PID:11656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        6⤵
        
        PID:15744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
        6⤵
        
        PID:18668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51324.exe
        5⤵
        
        PID:12720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28884.exe
        5⤵
        
        PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22123.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38862.exe
        6⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39841.exe
        7⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
        7⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        7⤵
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
        6⤵
        
        PID:11140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14036.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40856.exe
        6⤵
        
        PID:13044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36404.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8667.exe
        5⤵
        
        PID:12232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49589.exe
        5⤵
        
        PID:16740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54149.exe
      4⤵
      PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62510.exe
        5⤵
        
        PID:6172
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6172 -s 488
        6⤵
        Program crash
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        5⤵
        
        PID:11700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exe
        5⤵
        
        PID:15692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
        5⤵
        
        PID:11556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48108.exe
      4⤵
      PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47278.exe
        5⤵
        
        PID:10276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14228.exe
        5⤵
        
        PID:17148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1191.exe
        5⤵
        
        PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
      4⤵
      PID:11620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe
      4⤵
      PID:16864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10174.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38225.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
        5⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47502.exe
        6⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        7⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
        7⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39116.exe
        7⤵
        
        PID:17708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        6⤵
        
        PID:14052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
        6⤵
        
        PID:16316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43183.exe
        5⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        6⤵
        
        PID:13264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        6⤵
        
        PID:16352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        6⤵
        
        PID:12500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55052.exe
        5⤵
        
        PID:10312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        5⤵
        
        PID:14828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-317.exe
        5⤵
        
        PID:15728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31150.exe
        5⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        6⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17838.exe
        7⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        7⤵
        
        PID:13456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51518.exe
        7⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17287.exe
        6⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20206.exe
        6⤵
        
        PID:13548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11140.exe
        6⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13044.exe
        5⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        6⤵
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25083.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        6⤵
        
        PID:9572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
        5⤵
        
        PID:10744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54956.exe
        5⤵
        
        PID:16240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23168.exe
        5⤵
        
        PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48284.exe
      4⤵
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exe
        5⤵
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29950.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        6⤵
        
        PID:14032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42853.exe
        6⤵
        
        PID:17472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44008.exe
        5⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        5⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61317.exe
        5⤵
        
        PID:17720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
      4⤵
      PID:7272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10285.exe
        5⤵
        
        PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        5⤵
        
        PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exe
      4⤵
      PID:12248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24388.exe
      4⤵
      PID:16840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58814.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45950.exe
        5⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46241.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45406.exe
        7⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        8⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8555.exe
        8⤵
        
        PID:16600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56257.exe
        8⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe
        7⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
        7⤵
        
        PID:17052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5844.exe
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33093.exe
        6⤵
        
        PID:11652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
        6⤵
        
        PID:17696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        5⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        6⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
        7⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2795.exe
        7⤵
        
        PID:16312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60469.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        6⤵
        
        PID:16712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26699.exe
        5⤵
        
        PID:8792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5757.exe
        6⤵
        
        PID:11736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12116.exe
        6⤵
        
        PID:16416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
        6⤵
        
        PID:12016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9828.exe
        5⤵
        
        PID:11440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60142.exe
        5⤵
        
        PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58949.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43086.exe
        5⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        6⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3469.exe
        6⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10084.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        5⤵
        
        PID:14024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        5⤵
        
        PID:19244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17547.exe
      4⤵
      PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        5⤵
        
        PID:10856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25467.exe
        5⤵
        
        PID:16284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exe
        5⤵
        
        PID:11884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53157.exe
      4⤵
      PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
      4⤵
      PID:16964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65166.exe
      4⤵
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
        5⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        6⤵
        
        PID:7528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        6⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36142.exe
        6⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        5⤵
        
        PID:9936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        5⤵
        
        PID:14008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44405.exe
        5⤵
        
        PID:17836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3812.exe
      4⤵
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56286.exe
        5⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59813.exe
        5⤵
        
        PID:14784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39116.exe
        5⤵
        
        PID:17700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18459.exe
      4⤵
      PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51749.exe
      4⤵
      PID:15256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54572.exe
      4⤵
      PID:16512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38055.exe
    3⤵
    PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe
      4⤵
      PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        5⤵
        
        PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        5⤵
        
        PID:13328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        5⤵
        
        PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12580.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
      4⤵
      PID:14044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
      4⤵
      PID:17908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
    3⤵
    PID:7940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40993.exe
      4⤵
      PID:9824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11572.exe
      4⤵
      PID:15220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
      4⤵
      PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61239.exe
    3⤵
    PID:9712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46732.exe
    3⤵
    PID:14624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
    3⤵
    PID:17064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14176.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-352.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33809.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33041.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3661.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22510.exe
        8⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        9⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
        10⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        10⤵
        
        PID:12560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
        10⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55061.exe
        9⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26075.exe
        9⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30949.exe
        9⤵
        
        PID:15968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        9⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44757.exe
        8⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39694.exe
        9⤵
        
        PID:12856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        9⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18267.exe
        8⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        8⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40856.exe
        8⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        8⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
        8⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51518.exe
        8⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24203.exe
        7⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13652.exe
        8⤵
        
        PID:16992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        7⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35355.exe
        7⤵
        
        PID:18684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51637.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24046.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
        8⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30334.exe
        9⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        9⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60341.exe
        9⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61029.exe
        8⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        8⤵
        
        PID:13972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60741.exe
        8⤵
        
        PID:17980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        7⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
        8⤵
        
        PID:18516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
        7⤵
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62469.exe
        7⤵
        
        PID:18104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
        6⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29070.exe
        7⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53925.exe
        8⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31717.exe
        8⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61105.exe
        8⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
        7⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
        7⤵
        
        PID:16220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        7⤵
        
        PID:12572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25445.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22779.exe
        6⤵
        
        PID:11540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29511.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52862.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54990.exe
        7⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54622.exe
        8⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40910.exe
        9⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40980.exe
        9⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26619.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        9⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4615.exe
        8⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14420.exe
        8⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13044.exe
        7⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        8⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe
        8⤵
        
        PID:15116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24891.exe
        8⤵
        
        PID:16652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
        7⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22283.exe
        7⤵
        
        PID:16176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        7⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        7⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        7⤵
        
        PID:15784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
        6⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        6⤵
        
        PID:14864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55486.exe
        6⤵
        
        PID:15796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3903.exe
        6⤵
        
        PID:12140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64303.exe
        5⤵
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
        6⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        8⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24891.exe
        8⤵
        
        PID:16632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33947.exe
        7⤵
        
        PID:12604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        7⤵
        
        PID:17684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36015.exe
        6⤵
        
        PID:9556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19444.exe
        6⤵
        
        PID:13916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13916 -s 464
        7⤵
        Program crash
        
        PID:14376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21515.exe
        6⤵
        
        PID:18756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46853.exe
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30113.exe
        6⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30334.exe
        7⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
        7⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        7⤵
        
        PID:15828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61029.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        6⤵
        
        PID:14184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44405.exe
        6⤵
        
        PID:17844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48575.exe
        5⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37470.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25083.exe
        6⤵
        
        PID:15952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        6⤵
        
        PID:12568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41454.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49377.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52862.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39806.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22142.exe
        8⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33742.exe
        10⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43912.exe
        10⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1191.exe
        10⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30757.exe
        9⤵
        
        PID:16620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61105.exe
        9⤵
        
        PID:13000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exe
        8⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63512.exe
        8⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30942.exe
        8⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42868.exe
        8⤵
        
        PID:18764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7598.exe
        7⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14420.exe
        7⤵
        
        PID:16184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7991.exe
        7⤵
        
        PID:12708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
        6⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        8⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64005.exe
        8⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        8⤵
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4999.exe
        7⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30757.exe
        7⤵
        
        PID:16592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        7⤵
        
        PID:12316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51375.exe
        6⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        7⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17527.exe
        7⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24427.exe
        6⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exe
        6⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        5⤵
        
        PID:528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59214.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        7⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25918.exe
        8⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10503.exe
        8⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19805.exe
        8⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56613.exe
        7⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24789.exe
        7⤵
        
        PID:15672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5844.exe
        6⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5181.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11348.exe
        7⤵
        
        PID:16364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        6⤵
        
        PID:18008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
        6⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24382.exe
        7⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        7⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40856.exe
        7⤵
        
        PID:13212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54693.exe
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        6⤵
        
        PID:16296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
        6⤵
        
        PID:13256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58309.exe
        5⤵
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23163.exe
        5⤵
        
        PID:12420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34004.exe
        5⤵
        
        PID:17476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27102.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3469.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6749.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29070.exe
        7⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3245.exe
        8⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        8⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32980.exe
        7⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exe
        7⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4233.exe
        7⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5844.exe
        6⤵
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
        6⤵
        
        PID:13032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62469.exe
        6⤵
        
        PID:18116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
        5⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
        6⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39841.exe
        7⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        7⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
        6⤵
        
        PID:11160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        6⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54556.exe
        5⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
        6⤵
        
        PID:12728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6740.exe
        6⤵
        
        PID:17516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56524.exe
        5⤵
        
        PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        5⤵
        
        PID:16952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
      4⤵
      Executes dropped EXE
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57102.exe
        5⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        6⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60469.exe
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24315.exe
        6⤵
        
        PID:18748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30836.exe
        5⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
        5⤵
        
        PID:13416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63813.exe
        5⤵
        
        PID:16672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63928.exe
        5⤵
        
        PID:11524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7243.exe
      4⤵
      PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        5⤵
        
        PID:9160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        5⤵
        
        PID:12540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52094.exe
        5⤵
        
        PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4868.exe
      4⤵
      PID:9980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13997.exe
      4⤵
      PID:13984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40092.exe
      4⤵
      PID:17992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29879.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9421.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64974.exe
        6⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45326.exe
        8⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
        8⤵
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19805.exe
        8⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55061.exe
        7⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26075.exe
        7⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31717.exe
        7⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
        7⤵
        
        PID:12180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44188.exe
        6⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42501.exe
        6⤵
        
        PID:11324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52076.exe
        6⤵
        
        PID:17932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5613.exe
        6⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        7⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        7⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55452.exe
        7⤵
        
        PID:17760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exe
        6⤵
        
        PID:10988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30949.exe
        6⤵
        
        PID:16680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16891.exe
        5⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55342.exe
        6⤵
        
        PID:11952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        6⤵
        
        PID:16900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13463.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54572.exe
        5⤵
        
        PID:16092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48254.exe
        5⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
        6⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        7⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45029.exe
        7⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        7⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        7⤵
        
        PID:12488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        6⤵
        
        PID:11396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50165.exe
        6⤵
        
        PID:17212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
        6⤵
        
        PID:11980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37172.exe
        5⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        6⤵
        
        PID:14832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12116.exe
        6⤵
        
        PID:996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43656.exe
        6⤵
        
        PID:12932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58828.exe
        5⤵
        
        PID:11580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63928.exe
        5⤵
        
        PID:12548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58076.exe
      4⤵
      PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45022.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        6⤵
        
        PID:10792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41420.exe
        6⤵
        
        PID:15872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13833.exe
        6⤵
        
        PID:13088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        5⤵
        
        PID:10736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        5⤵
        
        PID:15736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25445.exe
      4⤵
      PID:8204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22779.exe
      4⤵
      PID:11456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exe
      4⤵
      PID:16980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64767.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64289.exe
        5⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
        6⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
        7⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        7⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63893.exe
        7⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10377.exe
        7⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        6⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        6⤵
        
        PID:14068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        6⤵
        
        PID:15584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34955.exe
        5⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23742.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34698.exe
        6⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31829.exe
        5⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17291.exe
        5⤵
        
        PID:17796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
      4⤵
      PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        5⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        6⤵
        
        PID:10816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        6⤵
        
        PID:16448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23393.exe
        6⤵
        
        PID:12664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50085.exe
        5⤵
        
        PID:11336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        5⤵
        
        PID:16304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        5⤵
        
        PID:12328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19579.exe
      4⤵
      PID:8212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4413.exe
        5⤵
        
        PID:11352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        5⤵
        
        PID:15668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31829.exe
      4⤵
      PID:12804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33819.exe
      4⤵
      PID:18632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8087.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64590.exe
      4⤵
      PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22142.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40225.exe
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64005.exe
        6⤵
        
        PID:1344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7991.exe
        6⤵
        
        PID:216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4999.exe
        5⤵
        
        PID:11016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        5⤵
        
        PID:16076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        5⤵
        
        PID:12492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35828.exe
      4⤵
      PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        5⤵
        
        PID:10936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exe
        5⤵
        
        PID:15760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15120.exe
        5⤵
        
        PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
      4⤵
      PID:10636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54572.exe
      4⤵
      PID:15996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63729.exe
      4⤵
      PID:12600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45484.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35982.exe
      4⤵
      PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        5⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        5⤵
        
        PID:13360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25467.exe
        5⤵
        
        PID:16268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        5⤵
        
        PID:9576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27291.exe
      4⤵
      PID:10376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22667.exe
      4⤵
      PID:15884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
    3⤵
    PID:7420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47278.exe
      4⤵
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60357.exe
      4⤵
      PID:16204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
    3⤵
    PID:10592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14588.exe
    3⤵
    PID:16764
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:8
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9805.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29998.exe
        6⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
        7⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        8⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        8⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        7⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
        7⤵
        
        PID:14060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        7⤵
        
        PID:17948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exe
        6⤵
        
        PID:9652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53061.exe
        6⤵
        
        PID:13564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23581.exe
        6⤵
        
        PID:16532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26379.exe
        5⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        6⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3463.exe
        6⤵
        
        PID:11856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        6⤵
        
        PID:15976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18916.exe
        5⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3083.exe
        5⤵
        
        PID:12404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44557.exe
        5⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53882.exe
        5⤵
        
        PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41252.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31150.exe
        5⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        6⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43150.exe
        7⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30769.exe
        7⤵
        
        PID:17388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60469.exe
        6⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exe
        6⤵
        
        PID:15684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50289.exe
        6⤵
        
        PID:11892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        5⤵
        
        PID:8156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe
        6⤵
        
        PID:19372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        5⤵
        
        PID:12392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53230.exe
        5⤵
        
        PID:17892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13559.exe
        5⤵
        
        PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48284.exe
      4⤵
      PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
        5⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        6⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7248.exe
        6⤵
        
        PID:12676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33556.exe
        5⤵
        
        PID:11316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31717.exe
        5⤵
        
        PID:16392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe
      4⤵
      PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63038.exe
        5⤵
        
        PID:11332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44405.exe
        5⤵
        
        PID:16496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7968.exe
        5⤵
        
        PID:13140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56028.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7284.exe
      4⤵
      PID:17004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51032.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41902.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15966.exe
        5⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39329.exe
        6⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        7⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
        7⤵
        
        PID:16432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49701.exe
        6⤵
        
        PID:11504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14036.exe
        6⤵
        
        PID:16880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21604.exe
        5⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        6⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57647.exe
        6⤵
        
        PID:16328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
        5⤵
        
        PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54572.exe
        5⤵
        
        PID:16036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40656.exe
        5⤵
        
        PID:18576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28004.exe
      4⤵
      PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37793.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8237.exe
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58469.exe
        6⤵
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52094.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exe
        5⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48245.exe
        5⤵
        
        PID:16340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        5⤵
        
        PID:12892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49071.exe
      4⤵
      PID:7148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14532.exe
      4⤵
      PID:10608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5371.exe
      4⤵
      PID:16552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22123.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63521.exe
      4⤵
      PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5805.exe
        5⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19950.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25454.exe
        7⤵
        
        PID:18676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        6⤵
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58332.exe
        6⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50261.exe
        5⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20206.exe
        5⤵
        
        PID:12312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        5⤵
        
        PID:15660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44188.exe
      4⤵
      PID:8692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42501.exe
      4⤵
      PID:11564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10941.exe
      4⤵
      PID:5972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63941.exe
    3⤵
    PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
      4⤵
      PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29950.exe
        5⤵
        
        PID:10228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4486.exe
        6⤵
        
        PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        5⤵
        
        PID:13492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44405.exe
        5⤵
        
        PID:17856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37956.exe
      4⤵
      PID:7460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
      4⤵
      PID:14392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
      4⤵
      PID:3676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe
    3⤵
    PID:7860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14525.exe
      4⤵
      PID:14820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
      4⤵
      PID:16924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
    3⤵
    PID:12960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15507.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15507.exe
    3⤵
    PID:17896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17684.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17684.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36644.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57102.exe
        5⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        6⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        7⤵
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59205.exe
        7⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60469.exe
        6⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        6⤵
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        5⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        5⤵
        
        PID:12340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27476.exe
        5⤵
        
        PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
      4⤵
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        5⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7213.exe
        6⤵
        
        PID:12648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe
        6⤵
        
        PID:17880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        5⤵
        
        PID:13336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        5⤵
        
        PID:16228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5467.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23581.exe
      4⤵
      PID:14868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
      4⤵
      PID:12880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64303.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57761.exe
      4⤵
      PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55774.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46094.exe
        6⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
        6⤵
        
        PID:14192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58332.exe
        6⤵
        
        PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
        5⤵
        
        PID:10352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        5⤵
        
        PID:16108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13044.exe
      4⤵
      PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37454.exe
        5⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
        5⤵
        
        PID:12564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8171.exe
        5⤵
        
        PID:16872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        5⤵
        
        PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41324.exe
      4⤵
      PID:10280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22283.exe
      4⤵
      PID:16160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40656.exe
      4⤵
      PID:11288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
    3⤵
    PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13344.exe
        5⤵
        
        PID:11716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12116.exe
        5⤵
        
        PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
      4⤵
      PID:13384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58332.exe
      4⤵
      PID:1256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe
    3⤵
    PID:10036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
      4⤵
      PID:14772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe
      4⤵
      PID:5820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62469.exe
    3⤵
    PID:14108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39918.exe
    3⤵
    PID:1852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48168.exe
    3⤵
    PID:12048
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61967.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61967.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45566.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58549.exe
        6⤵
        
        PID:12024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        6⤵
        
        PID:16060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        6⤵
        
        PID:12888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15460.exe
        5⤵
        
        PID:9096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
        5⤵
        
        PID:13408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30949.exe
        5⤵
        
        PID:16720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe
        5⤵
        
        PID:11844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16484.exe
      4⤵
      PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19182.exe
        5⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        5⤵
        
        PID:13100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38156.exe
        5⤵
        
        PID:17964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
      4⤵
      PID:8900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
      4⤵
      PID:13944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53695.exe
      4⤵
      PID:16792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10132.exe
    3⤵
    PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43086.exe
      4⤵
      PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16302.exe
        5⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        5⤵
        
        PID:12844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        5⤵
        
        PID:18616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12297.exe
        5⤵
        
        PID:12092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
      4⤵
      PID:10044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
      4⤵
      PID:14016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
      4⤵
      PID:13924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40821.exe
    3⤵
    PID:7376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41505.exe
      4⤵
      PID:11960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-957.exe
      4⤵
      PID:1020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7892.exe
    3⤵
    PID:12268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45095.exe
    3⤵
    PID:2284
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48423.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48423.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15581.exe
    3⤵
    PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
      4⤵
      PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34366.exe
        5⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        5⤵
        
        PID:15836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
      4⤵
      PID:10068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16267.exe
      4⤵
      PID:14076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14420.exe
      4⤵
      PID:15896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37749.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25054.exe
      4⤵
      PID:16008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
    3⤵
    PID:13376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28500.exe
    3⤵
    PID:6244
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe
  2⤵
  PID:5456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
    3⤵
    PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
      4⤵
      PID:10864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58140.exe
      4⤵
      PID:16400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
      4⤵
      PID:9616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32980.exe
    3⤵
    PID:11940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
    3⤵
    PID:15572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14985.exe
    3⤵
    PID:11796
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe
  2⤵
  PID:7868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
    3⤵
    PID:11292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49774.exe
    3⤵
    PID:19444
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62365.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62365.exe
  2⤵
  PID:11528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
  2⤵
  PID:16944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6172 -ip 6172
1⤵
PID:9284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 14128 -ip 14128
1⤵
PID:132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:14996

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10174.exe

Filesize
468KB

MD5
6928f44077e289fc9c8d78b10f63b7e9

SHA1
7e5942c3786cfff398ffe52f5bd400dfc505f60e

SHA256
9a85d400c98c5f32a303b7ac360c7dadf7b946e01e0ac03e7441f23bcc987d0e

SHA512
c30cc9bcb4f3772ae236b6561928bca25a877973fd9e234ea0c5683b8ad0e1658985ce78d4c5975a6aa5eee32c4869554e39760dd12bceaf6543f7d134042f3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe

Filesize
468KB

MD5
06e250814f4f4f4ae9e43a47c6655798

SHA1
9d4a186a4982073586f96b0d60e89b224ad81c01

SHA256
5fa09eeec74b07a5b0cf427a7f5beca92cdf83d3e2383e6322c3cb22395a784a

SHA512
e86f2193fa8e7f68c2c6affc8c5960d8959d5b586533e9267d0328ae934ac45b3682ec19c5a260a2683a10ef87d232ea47c710a6efd6269b7be92541350fd77c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14176.exe

Filesize
468KB

MD5
9a683a5a3c2fbe85fa43750f1a6f8706

SHA1
d7366fe47f57c5cbd047acbcab10581d9aaedf6e

SHA256
aa3b41bc2c75d82b897ea7bdbbf170b541ccf13119ad1962068ce92d8406a414

SHA512
a172823ba3c367e736efa8920e10ac75a2fd6a2bf29fd73f315018f0f0b0ff817fe425425382fe04e0072b12ac2bf8e98bd2d04b253f60cc8cb7ac67b43eae5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17684.exe

Filesize
468KB

MD5
fd8f92dcde3bc5493e20c2ea70c6e796

SHA1
d1b160af119e8f339ad9a5e70e79b4103ce24862

SHA256
d5e5bfd69313cd772995ffaac7915cb9c8cfc998eaa5f636f108be1d98794816

SHA512
5ea574177e3a5d45136501157f4589c9bf0da6ecea2c7ce7d7fb28170dad0b6f701266f90afafe3b57909bad8271dd5136f3eef8a22edb0d4d67f4aed74c03e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2023.exe

Filesize
468KB

MD5
e2cce21d8cb2d92416fd14f388f37f5a

SHA1
ec2f015a0a739692be0bee7dc56a8ca8b36a8a2e

SHA256
62458943759fce606a2be769f94b1fd54a2d21ccf6e790858e839504b8fa9bfc

SHA512
2f0ec9b3d28d9962fb6d9c29d34bd02c10b1d45793d0a41e5a5b46855a8d0fcc4679e7763569b212b14ff675ec547e284280235c35f91169a99c0622b1c24b17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe

Filesize
468KB

MD5
833deed61efd3b4dd79d330108231fc6

SHA1
2ce8ff51b7e739627fd9b54df7f500c83aa6e047

SHA256
87128bbd39333fd8c56213ef05342b23fce494558de0535021087304826171f2

SHA512
94068d85a85ef8df4c77311f7f99cada2d239f2bc460fc873892da1844fde8829bdc67be320c4bd95e3d18d8784ec575b900418b59ce46d9f92061a0ac2a8dba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe

Filesize
468KB

MD5
883e9524acd53ec92d3cd99a01e54192

SHA1
db1434d0221351046521bdf7fa811555c7697e41

SHA256
18baa70ee62e391e38350f1db27197fe15f528f6b74adddd9b2d72d7f800f20c

SHA512
a3ce30abe682bc6089890f0891861acfa3d7720e43a2f9ed8f65da6b855c24465f95ba797e3e7f23673c046f9e67ddb4c826498d5d6d20d3e0a14bc3c05eb28c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2672.exe

Filesize
468KB

MD5
e16e702761bb3dd04d8efdefb6f0ac48

SHA1
4f92e495f09845b92f7b89e93e2f857f3697ce44

SHA256
20dda2ec74c5abb7559cc6c639b185a911961dc7d0f5e236b81872381582ca92

SHA512
d73587ea60f07f65037219c3ad2af2f541f3278bd29fbb2aa90b05dcab7fb95b52e9a4a66356e566429b5b4990e055545b31e938426e4ffa3dccd6e7f84f31cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26791.exe

Filesize
468KB

MD5
00fed1803ad52110cd886f489077a8ac

SHA1
ce63bfb4d37e3bef3a221d511f74cc200bfa9bb7

SHA256
d0424d4fb4738cf04d4f3986b0d33c19ec6b6f68921b128fa8e7f6d7a34f4114

SHA512
424d9f2315121b8ec5c24006578623adb8011729f095fa36ccd83f97483f44e5aabcbcc398e365d7ac6c01953357b95b136eb75e25ae96c1cfc028f903a68aa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27102.exe

Filesize
468KB

MD5
8566d9eb9cbeec5cd7a6f4788227fdd3

SHA1
c0b1cc42de4f112565bfe1fc48624d6feccebaec

SHA256
4658847699eca031fcca077403789342bef0ed8d65359a5fd5b18b5ad57219c3

SHA512
2dc012dbb53c0b60fd0edd8d1ffca3e986d340f0f1f461c8358de5a3e8f54bc20cf1c36e143daaf13f4dd6f49ef50e394c78fad3262b62119da5b83ad40d8067

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29511.exe

Filesize
468KB

MD5
dd09a2a92cf009bee8bc184a4b4f867e

SHA1
39136b97bb6dce32cea991f050479039ef3d620c

SHA256
9e262d4a362320552504b0b9151a52cce9f3db19cbaf4250e92c4d95c0b82463

SHA512
d1cb2e274b8834a9a28f7b84c44d9ccee98b9063fbd64c2e319e143aafa91df80b75b9fcbfdfd471f6db5929931a7836ea4454d932e5c533612ba24e9e532912

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29879.exe

Filesize
468KB

MD5
d75282ea594212a85dd0bea8b2521b6d

SHA1
af9f9d3c60a96e8ec8a1a8bb6bda265fc6c7f3b6

SHA256
2ff53178b9cb513c6fc2f6efc0054ea1ca5da2b23bf86f2eef825006906dae03

SHA512
9440c917b9c11bdbe042bb0257db62a01c2594dc297cf1779e90166375fbb8af6ecfff7d30a1063b616aa60e3d7f49cbaec159798877164cd4d8bb774d4e23bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe

Filesize
468KB

MD5
e58d5738f63698a931c99e47ce8a50d2

SHA1
66fbdecc35e2f027a9e26d7d77845b03750a329b

SHA256
931f85bec699bc9d4989dfb0ce941c33a4c62ec4e340a8114656e752e9cf6ac7

SHA512
f702fc3f7d6f1cf32cc1b6f0c67aef3fdaeb2368d505d511d7e8c1953a4bf17edb639310b7c5cd7dbfe7474becadf7417087d9c033e03cba6fa6ea72a5af9e41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32833.exe

Filesize
468KB

MD5
af59a4ef7579dddc65631776f8ca91a7

SHA1
8e2e72787e3c5d5ab68a246e923390d62d8077f7

SHA256
6d664aa27a5206ba120cc70d0122ac63e0ff3235f012e225e009a26cffaad899

SHA512
05f7caf6e8ca2a0a65b85dafee2182f9d5f60677fc19782e08e871f6a61b72ccf50e956931a8e6de96042761ae7e2e0c890f997851a04953ffd02dd8bbacf371

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33041.exe

Filesize
468KB

MD5
08775704c97bc7198dad6ea7ac6ca50d

SHA1
17b3b87d7fe6a9ff7b5b9b3a638b8b6310a3d476

SHA256
4c3f5ec4823b3fb1810349064270dc90934ba6cce7770b4d0a02bbec578a0403

SHA512
b5eb060b61a163b25622285784fd2a4fe79984df5910ee6ec27b82598aae509edcc9706cfa313a369ce2c584f9d0b071306699a42becd435b7289128dbe28ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe

Filesize
468KB

MD5
7a0d9b84ae057c64bae30fcef42d9d2b

SHA1
fd56281a6850faf4db308deaaba96cef9fbfcaad

SHA256
140339d4eadebb9eb6c327a8a808925f08868983ad9eef2d48876899a66976cb

SHA512
e24126965127a82af3de56a12b2f7039779ab7c61f8d8c7b56c4fdd1f02e1105615b96cd6dc6fa4e2cd4a14f60e721f7f52a5db546a170190f06a2041aa73063

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33809.exe

Filesize
468KB

MD5
656dbf1f9dd64d057a875e9dcc18de80

SHA1
44507fa6eb48b608b1f2541c5cc69ea6a284ff91

SHA256
cecf2fe518fcb68ae903708b459dbd91559f9930135e7f239bea4784bad84fa0

SHA512
0bdf280ad2e2e178b2cccf8a58455d1b1876be21163eb891a0e3dc3ae53feda1a88704e9ac6975ab7d1f49dae8385f439bb7b6c5f61a1906bbbea4e8a39d4ff8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-352.exe

Filesize
468KB

MD5
cb543f331ee6eddb0ce416bfa4fda1b1

SHA1
13520a213f36c0228f778acd9f09ab40b3ac7d67

SHA256
8984343bae86947d9938fe6fc73e6cbbc07da8479b98a08b8b8fdb5bbed458cf

SHA512
c0ff58b5e8fd94d3ad0e97099a073bee8951be513990be11292e3188e9c93bc2afd1c9f36cfa2df4f141df9f3dcbbcdd4ac9f545bd83b5145124a727d4f8d539

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe

Filesize
468KB

MD5
e72328824216b9f551f58c1d6244f346

SHA1
8929c3cf20f0cb1b40dee5b51ae536683862ddd2

SHA256
7e0763f3ee265b1f3e234663b8da5e04ffcf73557a9e2a4ae4025b8039c69ff0

SHA512
3bab98e76738ac7b3d8208c3afa541167eea7ab37af347314e5879be2b927fec2f1b03dfdc644a795866415b6fca990552a25748a4ff2ea32700eff7aabe3df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38225.exe

Filesize
468KB

MD5
fdb03ea38ab36ac1541071e3717122d3

SHA1
9f913c6361ce186b8ef6e53ff07f704f334bf9f8

SHA256
1307280d432f41ac1f8ec27662ac91dd14c7c86a603a2768bf22b3ec420e3e85

SHA512
1817bf6507e7a2e5c6b2cece0865b8010ea5ab1172481311a55309e4a1df0342ce43f2ef3faf27bd62f9a434e9c676eba9b81ebf985eb7841bc503472a35ed96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe

Filesize
468KB

MD5
594d70a0802efbf7c324104835868b2e

SHA1
a4b497be81e9f966a73c436897b49f6560408976

SHA256
7447610afb796861572c9e436dbbf78719ec8ab38ae465593f589693a32760d5

SHA512
d58048cf6b3016a2fd5a6bfb2d24c27c647ddb6a86a120622a27f36e3a51a0cd7421dcd7f27eac530df736e8695123c970e79ba11fefcbc23cf3620a71534faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46657.exe

Filesize
468KB

MD5
77fc7408590773645c9e600a032e195b

SHA1
fb967d34872d01ac1a4fd5ae75826ab36d3aa45b

SHA256
09f21401e6a7b712f1cc0b33e21ca5725ab33f9e7c939263c45cc3bd64dde921

SHA512
f3416a59e641c70461136737050182e7f05f99ea3ed7849ed47a4caaf6fea666e9f5ee352e41b83d78b193329c0ad5e389231a4c4c2c0fec795b259efc847a5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe

Filesize
468KB

MD5
db96c56b9ed3d3eec65c98fa43f67920

SHA1
ac4bc35108e624c9fa12455b9f9f1cd5300cfc63

SHA256
c9a27ce69773062dabc7e6bed2c72f36153affa87b5f4e3a1355fd6431432660

SHA512
7bea6b713dfcaba9cf2c1066b45d6c47417abf24ab6e246071cec5d1fe68ae6ff3ab7e0292a2277670eeae568cc587685bfe79ff333fbd90206f71d7c3ae8755

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49169.exe

Filesize
468KB

MD5
9f53bde1735a4b40dd9bcbb8156a218b

SHA1
c878fe0368ac2f28d6eb8b7f18e06957ad7ad19e

SHA256
487687a09c4e3e3d9eb8124e736b44786f22d3aa29a957b8641a2bc3b9a993ad

SHA512
40d5d0e9f4c0d0adf5f2db5969462920ce6c68f3f8df3bcf1c592e816048ae237bffe0579a0bbbea9fe814420f728693da48fbd2a32a8dd7e9343ed4cc5a3c30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49377.exe

Filesize
468KB

MD5
5f0ae8a62f0eeda065765fd710fd99d3

SHA1
fbc1047be9c266ba102af81af6659ddf5687350e

SHA256
7673c1fcc064ec80a735ecbaa536dfed44f02c925ddf2474de229d039877c1c5

SHA512
df6549ff8983c6fb73aa3b439e58644332a379744c19cfa19366a30dc8bc678f97c3a2f68a491c889cf40b24569a61f00407271e774a7d064182f6554f5c0835

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe

Filesize
468KB

MD5
22ffd83f7796f62bc770b588c1bba5e0

SHA1
473170df0afe573d5fa1c46d0a415a0b96b0020a

SHA256
a850cc7bcf9135e616322f06b9577b9a574075bb94a000f0fee580f104603ccb

SHA512
e444723f8151eb5d370a9eab5de39b95a663e3f955242cf3568a768d5d849f20400f997e542db5626603e5ae59e4687bfd32cfd83dbd5962401fd543e711840d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51032.exe

Filesize
468KB

MD5
2f3d266d6baed52a65b83c23aa1cf665

SHA1
6fe6f0f118d38fbc5e68e637ba476cfb0ef1fe2c

SHA256
443450eed8d4621891a237d77b63449c9b16c270790013c6867bc6257e1518a4

SHA512
d98d941906d3452f4cc36069f1a6b02fe955e8001daa360edfcd0b5aa4d3889f7c9b40fe992bb0d980c67f22da951af92548803ffaf0d95e1fb80de97f35648d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51073.exe

Filesize
468KB

MD5
cd22e579744474b467d2303d51b8dba3

SHA1
c3c748279323956115c81d54d5a32e42e88712b2

SHA256
52257c9095ba806a951e0830295d58c59f145f9041c3ab93a6e88d4d7ab60883

SHA512
58d884420eea2d5bd3a434b0263b90a5d8cb8e87ce5f6e60f4e29a44c952cb289a4aba4c78edfa803a0d5be6234168590f761585095c78600d7f4fef2f0b1fd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61967.exe

Filesize
468KB

MD5
9aeaa34f5bbc3a135ee51e6803d25366

SHA1
2e48e7f49c245f74c3dc343252f207c9723d38d4

SHA256
e9c80306713acc2835a0b778766a838af91b257af87a64c5a540563088f399d5

SHA512
47e685b0e3402021ae9f58ce5b224f69ae21e89ab150e83215c7b36eb12dcb7f44d033bfea6859fa7d4bf38ba30b8c37433c58ef97f2936f9b63cb513e5800cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64767.exe

Filesize
468KB

MD5
ed8f389da98fbbec40ef749130fad4bd

SHA1
f3d6c74de13d55633dd27f62a05b4bce243f3e0a

SHA256
737e80e7aa6e7b518c5db5dba4c09e72d17ba8b11b14d5c7216391fdd8428d7f

SHA512
ddff150556d70f3f882f1b7afc7a64fe19412ec40e707354fdc3a5cb4e84f310e7a24fd5a07d5ec522032ad127c415e7347a43e51ac7c41877fff9ecc7fad92e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe

Filesize
468KB

MD5
47d1168a5eef1ab31d01b014b11bfa12

SHA1
ef3f86b0f4e50cc05ae3a1526ffb4ba6df735353

SHA256
a878f9341310731c21d8884638b939e0ff668f295a727b1109118ecf49f5ae48

SHA512
ca8da278587606e6c19437d98b0965c40080aa52236b9948c942dcbd0134115fcd853813a7bbb383a3ee2cd17922be4ed7c7f1762f3dc704ff1ff572814c910e

Download Submit
memory/8-67-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/376-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/468-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/528-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/652-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/712-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/828-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/912-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1012-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1072-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1080-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1176-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1220-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1288-14-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1296-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1488-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1508-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1564-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1648-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1672-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1768-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-100-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2148-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-32-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2324-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2344-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2488-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2500-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2540-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2556-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2568-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2880-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2888-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3092-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3112-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3132-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3144-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3164-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3232-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3232-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3700-149-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3716-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3792-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3824-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3884-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3900-2329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3968-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4020-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4100-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4188-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4272-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4308-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4368-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4408-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4420-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4424-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4432-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4436-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4512-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4660-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4760-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4804-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-31-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4932-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5000-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5100-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5108-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5184-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5208-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5220-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5232-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5256-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5284-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5292-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5300-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5360-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5388-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5412-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5420-533-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5456-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5544-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13068-2345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14612-3651-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14876-2284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15116-2321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15548-3693-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/17064-3692-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/19428-4027-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads