9384d5738dec8c00ea10e6847d14a91509f6f29023af65aa9d31f926047c85d2

Analysis

max time kernel
120s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9384d5738dec8c00ea10e6847d14a91509f6f29023af65aa9d31f926047c85d2N.exe
Size

468KB
MD5

188ffddc065bb61b2c0399830c43ea30
SHA1

0cecf4e851667d45008d174c2cbe5163949f864e
SHA256

9384d5738dec8c00ea10e6847d14a91509f6f29023af65aa9d31f926047c85d2
SHA512

abad49fa30c13b2c7f5aa3a352a961fced0f8ab0f21b4a07556c6c24bd659dc879358da231d56363a436826337ca9d3f2281c7e5778a33a057f9aacd3ed9238b
SSDEEP

3072:fbcoogIdId5StbY1PzxjcfN/vCtvPIpPhcHeFShMBaM8VbZu3Tlc:fbPowbStaPVjcf00B1Ba11Zu3

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4988	Unicorn-17521.exe
472	Unicorn-56773.exe
4512	Unicorn-28739.exe
3468	Unicorn-25144.exe
4352	Unicorn-14515.exe
3344	Unicorn-23281.exe
4356	Unicorn-13066.exe
1128	Unicorn-21273.exe
3576	Unicorn-21273.exe
4892	Unicorn-6590.exe
592	Unicorn-12720.exe
4540	Unicorn-58392.exe
1996	Unicorn-8371.exe
2924	Unicorn-54308.exe
2388	Unicorn-7795.exe
2416	Unicorn-32513.exe
4792	Unicorn-15527.exe
2896	Unicorn-15793.exe
1828	Unicorn-15793.exe
740	Unicorn-51672.exe
4092	Unicorn-31806.exe
952	Unicorn-28791.exe
2412	Unicorn-42527.exe
4532	Unicorn-48657.exe
1596	Unicorn-44573.exe
3124	Unicorn-26190.exe
1708	Unicorn-12455.exe
3236	Unicorn-15222.exe
4984	Unicorn-5136.exe
3888	Unicorn-56375.exe
4704	Unicorn-51576.exe
4964	Unicorn-1820.exe
1812	Unicorn-15971.exe
1204	Unicorn-2588.exe
2088	Unicorn-31758.exe
220	Unicorn-8016.exe
4144	Unicorn-16547.exe
1480	Unicorn-65193.exe
3232	Unicorn-57025.exe
1840	Unicorn-32137.exe
2308	Unicorn-47703.exe
2632	Unicorn-11451.exe
456	Unicorn-49220.exe
1736	Unicorn-3548.exe
4884	Unicorn-43512.exe
3608	Unicorn-44197.exe
4124	Unicorn-25814.exe
2452	Unicorn-56127.exe
1544	Unicorn-4325.exe
3068	Unicorn-53112.exe
2772	Unicorn-56641.exe
3524	Unicorn-37373.exe
1604	Unicorn-51855.exe
3564	Unicorn-41265.exe
2108	Unicorn-13231.exe
2356	Unicorn-32832.exe
3032	Unicorn-20845.exe
1944	Unicorn-979.exe
444	Unicorn-12411.exe
5108	Unicorn-37949.exe
3600	Unicorn-25697.exe
2964	Unicorn-17529.exe
3224	Unicorn-60599.exe
2688	Unicorn-46864.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
5788	6656	WerFault.exe	243
9148	6856	WerFault.exe	253
9428	6848	WerFault.exe	252
10344	5476	WerFault.exe	278
8964	6052	WerFault.exe	279

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32677.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51592.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4960	dwm.exe
Token: SeChangeNotifyPrivilege	4960	dwm.exe
Token: 33	4960	dwm.exe
Token: SeIncBasePriorityPrivilege	4960	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
772	9384d5738dec8c00ea10e6847d14a91509f6f29023af65aa9d31f926047c85d2N.exe
4988	Unicorn-17521.exe
472	Unicorn-56773.exe
4512	Unicorn-28739.exe
4352	Unicorn-14515.exe
3468	Unicorn-25144.exe
4356	Unicorn-13066.exe
3344	Unicorn-23281.exe
3576	Unicorn-21273.exe
592	Unicorn-12720.exe
1128	Unicorn-21273.exe
2924	Unicorn-54308.exe
4892	Unicorn-6590.exe
4540	Unicorn-58392.exe
1996	Unicorn-8371.exe
2388	Unicorn-7795.exe
2416	Unicorn-32513.exe
1828	Unicorn-15793.exe
4792	Unicorn-15527.exe
952	Unicorn-28791.exe
3236	Unicorn-15222.exe
2412	Unicorn-42527.exe
2896	Unicorn-15793.exe
3124	Unicorn-26190.exe
4092	Unicorn-31806.exe
1708	Unicorn-12455.exe
740	Unicorn-51672.exe
1596	Unicorn-44573.exe
4532	Unicorn-48657.exe
4984	Unicorn-5136.exe
3888	Unicorn-56375.exe
4704	Unicorn-51576.exe
4964	Unicorn-1820.exe
1812	Unicorn-15971.exe
1204	Unicorn-2588.exe
2088	Unicorn-31758.exe
220	Unicorn-8016.exe
4144	Unicorn-16547.exe
1480	Unicorn-65193.exe
3232	Unicorn-57025.exe
1840	Unicorn-32137.exe
2308	Unicorn-47703.exe
456	Unicorn-49220.exe
2632	Unicorn-11451.exe
1736	Unicorn-3548.exe
3068	Unicorn-53112.exe
1544	Unicorn-4325.exe
4884	Unicorn-43512.exe
2452	Unicorn-56127.exe
3608	Unicorn-44197.exe
4124	Unicorn-25814.exe
1604	Unicorn-51855.exe
3524	Unicorn-37373.exe
1944	Unicorn-979.exe
2772	Unicorn-56641.exe
2108	Unicorn-13231.exe
2356	Unicorn-32832.exe
3032	Unicorn-20845.exe
444	Unicorn-12411.exe
3564	Unicorn-41265.exe
5108	Unicorn-37949.exe
2964	Unicorn-17529.exe
3224	Unicorn-60599.exe
2688	Unicorn-46864.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 4988	772	9384d5738dec8c00ea10e6847d14a91509f6f29023af65aa9d31f926047c85d2N.exe	82
PID 772 wrote to memory of 4988	772	9384d5738dec8c00ea10e6847d14a91509f6f29023af65aa9d31f926047c85d2N.exe	82
PID 772 wrote to memory of 4988	772	9384d5738dec8c00ea10e6847d14a91509f6f29023af65aa9d31f926047c85d2N.exe	82
PID 4988 wrote to memory of 472	4988	Unicorn-17521.exe	83
PID 4988 wrote to memory of 472	4988	Unicorn-17521.exe	83
PID 4988 wrote to memory of 472	4988	Unicorn-17521.exe	83
PID 772 wrote to memory of 4512	772	9384d5738dec8c00ea10e6847d14a91509f6f29023af65aa9d31f926047c85d2N.exe	84
PID 772 wrote to memory of 4512	772	9384d5738dec8c00ea10e6847d14a91509f6f29023af65aa9d31f926047c85d2N.exe	84
PID 772 wrote to memory of 4512	772	9384d5738dec8c00ea10e6847d14a91509f6f29023af65aa9d31f926047c85d2N.exe	84
PID 472 wrote to memory of 3468	472	Unicorn-56773.exe	85
PID 472 wrote to memory of 3468	472	Unicorn-56773.exe	85
PID 472 wrote to memory of 3468	472	Unicorn-56773.exe	85
PID 4988 wrote to memory of 4352	4988	Unicorn-17521.exe	86
PID 4988 wrote to memory of 4352	4988	Unicorn-17521.exe	86
PID 4988 wrote to memory of 4352	4988	Unicorn-17521.exe	86
PID 4512 wrote to memory of 3344	4512	Unicorn-28739.exe	87
PID 4512 wrote to memory of 3344	4512	Unicorn-28739.exe	87
PID 4512 wrote to memory of 3344	4512	Unicorn-28739.exe	87
PID 772 wrote to memory of 4356	772	9384d5738dec8c00ea10e6847d14a91509f6f29023af65aa9d31f926047c85d2N.exe	88
PID 772 wrote to memory of 4356	772	9384d5738dec8c00ea10e6847d14a91509f6f29023af65aa9d31f926047c85d2N.exe	88
PID 772 wrote to memory of 4356	772	9384d5738dec8c00ea10e6847d14a91509f6f29023af65aa9d31f926047c85d2N.exe	88
PID 4352 wrote to memory of 3576	4352	Unicorn-14515.exe	94
PID 3468 wrote to memory of 1128	3468	Unicorn-25144.exe	93
PID 4352 wrote to memory of 3576	4352	Unicorn-14515.exe	94
PID 4352 wrote to memory of 3576	4352	Unicorn-14515.exe	94
PID 3468 wrote to memory of 1128	3468	Unicorn-25144.exe	93
PID 3468 wrote to memory of 1128	3468	Unicorn-25144.exe	93
PID 4988 wrote to memory of 4892	4988	Unicorn-17521.exe	95
PID 4988 wrote to memory of 4892	4988	Unicorn-17521.exe	95
PID 4988 wrote to memory of 4892	4988	Unicorn-17521.exe	95
PID 3344 wrote to memory of 592	3344	Unicorn-23281.exe	96
PID 3344 wrote to memory of 592	3344	Unicorn-23281.exe	96
PID 3344 wrote to memory of 592	3344	Unicorn-23281.exe	96
PID 472 wrote to memory of 4540	472	Unicorn-56773.exe	97
PID 472 wrote to memory of 4540	472	Unicorn-56773.exe	97
PID 472 wrote to memory of 4540	472	Unicorn-56773.exe	97
PID 772 wrote to memory of 1996	772	9384d5738dec8c00ea10e6847d14a91509f6f29023af65aa9d31f926047c85d2N.exe	98
PID 772 wrote to memory of 1996	772	9384d5738dec8c00ea10e6847d14a91509f6f29023af65aa9d31f926047c85d2N.exe	98
PID 772 wrote to memory of 1996	772	9384d5738dec8c00ea10e6847d14a91509f6f29023af65aa9d31f926047c85d2N.exe	98
PID 4512 wrote to memory of 2924	4512	Unicorn-28739.exe	99
PID 4512 wrote to memory of 2924	4512	Unicorn-28739.exe	99
PID 4512 wrote to memory of 2924	4512	Unicorn-28739.exe	99
PID 4356 wrote to memory of 2388	4356	Unicorn-13066.exe	101
PID 4356 wrote to memory of 2388	4356	Unicorn-13066.exe	101
PID 4356 wrote to memory of 2388	4356	Unicorn-13066.exe	101
PID 4892 wrote to memory of 2416	4892	Unicorn-6590.exe	102
PID 4892 wrote to memory of 2416	4892	Unicorn-6590.exe	102
PID 4892 wrote to memory of 2416	4892	Unicorn-6590.exe	102
PID 4988 wrote to memory of 4792	4988	Unicorn-17521.exe	103
PID 4988 wrote to memory of 4792	4988	Unicorn-17521.exe	103
PID 4988 wrote to memory of 4792	4988	Unicorn-17521.exe	103
PID 592 wrote to memory of 2896	592	Unicorn-12720.exe	104
PID 592 wrote to memory of 2896	592	Unicorn-12720.exe	104
PID 592 wrote to memory of 2896	592	Unicorn-12720.exe	104
PID 2924 wrote to memory of 1828	2924	Unicorn-54308.exe	105
PID 2924 wrote to memory of 1828	2924	Unicorn-54308.exe	105
PID 2924 wrote to memory of 1828	2924	Unicorn-54308.exe	105
PID 3576 wrote to memory of 740	3576	Unicorn-21273.exe	106
PID 3576 wrote to memory of 740	3576	Unicorn-21273.exe	106
PID 3576 wrote to memory of 740	3576	Unicorn-21273.exe	106
PID 3344 wrote to memory of 4092	3344	Unicorn-23281.exe	107
PID 3344 wrote to memory of 4092	3344	Unicorn-23281.exe	107
PID 3344 wrote to memory of 4092	3344	Unicorn-23281.exe	107
PID 4352 wrote to memory of 952	4352	Unicorn-14515.exe	108

C:\Users\Admin\AppData\Local\Temp\9384d5738dec8c00ea10e6847d14a91509f6f29023af65aa9d31f926047c85d2N.exe
"C:\Users\Admin\AppData\Local\Temp\9384d5738dec8c00ea10e6847d14a91509f6f29023af65aa9d31f926047c85d2N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17521.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17521.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25144.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51576.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25697.exe
        7⤵
        Executes dropped EXE
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7928.exe
        8⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61649.exe
        9⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10714.exe
        10⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe
        10⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32811.exe
        9⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32639.exe
        9⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        8⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27841.exe
        9⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9260.exe
        9⤵
        
        PID:16252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        8⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45360.exe
        8⤵
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61420.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
        7⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35905.exe
        8⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        8⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63599.exe
        7⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
        8⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
        8⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22126.exe
        7⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12958.exe
        7⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39840.exe
        7⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60599.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42137.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62329.exe
        9⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61696.exe
        9⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe
        9⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28431.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
        8⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        8⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17471.exe
        7⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51525.exe
        8⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38099.exe
        8⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2466.exe
        8⤵
        
        PID:16980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41887.exe
        7⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13699.exe
        7⤵
        
        PID:13628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4238.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26533.exe
        7⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe
        7⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36276.exe
        7⤵
        
        PID:17544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40187.exe
        6⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7031.exe
        7⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10412.exe
        7⤵
        
        PID:16888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26199.exe
        6⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24425.exe
        6⤵
        
        PID:15408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12455.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37373.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8504.exe
        7⤵
        
        PID:388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
        8⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57560.exe
        8⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        7⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62516.exe
        8⤵
        
        PID:15684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60328.exe
        8⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12286.exe
        7⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16771.exe
        7⤵
        
        PID:15380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12603.exe
        7⤵
        
        PID:15708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38799.exe
        6⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27000.exe
        7⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        7⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1807.exe
        7⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14014.exe
        6⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58407.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        6⤵
        
        PID:14572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51855.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10512.exe
        6⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31037.exe
        7⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29081.exe
        8⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29725.exe
        9⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54076.exe
        9⤵
        
        PID:17192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31991.exe
        8⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8440.exe
        8⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
        7⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        7⤵
        
        PID:12756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24170.exe
        7⤵
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58592.exe
        6⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3808.exe
        7⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40595.exe
        7⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45965.exe
        7⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49183.exe
        6⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2687.exe
        6⤵
        
        PID:13004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        6⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61332.exe
        5⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe
        6⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6408.exe
        7⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30123.exe
        7⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        7⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39931.exe
        6⤵
        
        PID:13964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        6⤵
        
        PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59299.exe
        5⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42257.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        5⤵
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        5⤵
        
        PID:15428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        5⤵
        
        PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48657.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
        7⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41229.exe
        8⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51525.exe
        9⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        9⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        9⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32811.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33874.exe
        8⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8440.exe
        8⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
        7⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
        8⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41327.exe
        8⤵
        
        PID:15180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2767.exe
        8⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        7⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
        7⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65203.exe
        7⤵
        
        PID:17064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61903.exe
        6⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61317.exe
        7⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        7⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        7⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
        6⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        6⤵
        
        PID:13436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53112.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-336.exe
        6⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        7⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65209.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        8⤵
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60520.exe
        8⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
        7⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-714.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33329.exe
        7⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48695.exe
        6⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53601.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
        6⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61605.exe
        6⤵
        
        PID:15764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22218.exe
        5⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        6⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe
        7⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        7⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16026.exe
        7⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe
        6⤵
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-714.exe
        6⤵
        
        PID:11900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24777.exe
        6⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
        5⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3756.exe
        6⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53217.exe
        7⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
        7⤵
        
        PID:17232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        6⤵
        
        PID:12120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        6⤵
        
        PID:17268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54271.exe
        5⤵
        
        PID:8888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18776.exe
        5⤵
        
        PID:15024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26190.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25758.exe
        5⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18977.exe
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49117.exe
        7⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35883.exe
        7⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51392.exe
        7⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16807.exe
        6⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58903.exe
        6⤵
        
        PID:11604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4932.exe
        6⤵
        
        PID:14428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47247.exe
        5⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32915.exe
        6⤵
        
        PID:11952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18527.exe
        6⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe
        5⤵
        
        PID:8776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21432.exe
        6⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62516.exe
        6⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        6⤵
        
        PID:17344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32558.exe
        5⤵
        
        PID:12548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32832.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24265.exe
        5⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37965.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1068.exe
        7⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44976.exe
        7⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        7⤵
        
        PID:16236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7819.exe
        6⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
        6⤵
        
        PID:12256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56873.exe
        6⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
        5⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
        6⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
        6⤵
        
        PID:14784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23763.exe
        6⤵
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57071.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49340.exe
        5⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
        5⤵
        
        PID:18184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16294.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36459.exe
        5⤵
        
        PID:7304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37751.exe
        5⤵
        
        PID:11516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21623.exe
        5⤵
        
        PID:16208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64544.exe
        5⤵
        
        PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42571.exe
      4⤵
      PID:7760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56674.exe
      4⤵
      PID:12608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10072.exe
      4⤵
      PID:17108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56641.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe
        7⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33881.exe
        8⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61317.exe
        9⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        9⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65035.exe
        9⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
        8⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-714.exe
        8⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8139.exe
        8⤵
        
        PID:17216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
        7⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
        8⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29075.exe
        8⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61096.exe
        8⤵
        
        PID:17324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45012.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40011.exe
        7⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4859.exe
        7⤵
        
        PID:16832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50175.exe
        6⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        7⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19267.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60136.exe
        7⤵
        
        PID:12748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42987.exe
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51400.exe
        6⤵
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        6⤵
        
        PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13231.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39759.exe
        6⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26533.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19267.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24339.exe
        7⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50854.exe
        6⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64576.exe
        6⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19811.exe
        6⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35815.exe
        5⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32308.exe
        5⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
        6⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61015.exe
        6⤵
        
        PID:12816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56873.exe
        6⤵
        
        PID:15956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18178.exe
        5⤵
        
        PID:8784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9583.exe
        5⤵
        
        PID:11960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4.exe
        5⤵
        
        PID:17244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51524.exe
        5⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31037.exe
        6⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        7⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48571.exe
        7⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37221.exe
        7⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62692.exe
        6⤵
        
        PID:8404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40787.exe
        6⤵
        
        PID:12740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        6⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6790.exe
        5⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6942.exe
        6⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21268.exe
        6⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6999.exe
        5⤵
        
        PID:9276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
        5⤵
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54205.exe
        5⤵
        
        PID:16592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4325.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48193.exe
        5⤵
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43896.exe
        6⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63341.exe
        7⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42863.exe
        7⤵
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59176.exe
        7⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        6⤵
        
        PID:10288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45360.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe
        6⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7523.exe
        5⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        5⤵
        
        PID:11240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45360.exe
        5⤵
        
        PID:14928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65312.exe
        5⤵
        
        PID:16004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63414.exe
      4⤵
      PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53201.exe
        5⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31799.exe
        5⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14443.exe
        5⤵
        
        PID:12872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-766.exe
      4⤵
      PID:8820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30733.exe
      4⤵
      PID:12444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23782.exe
      4⤵
      PID:17304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6590.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6590.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32513.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37949.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36465.exe
        8⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25329.exe
        9⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        9⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40100.exe
        9⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47700.exe
        8⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62359.exe
        8⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-656.exe
        8⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19251.exe
        7⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61509.exe
        8⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        8⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31739.exe
        8⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22021.exe
        7⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54619.exe
        7⤵
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48776.exe
        7⤵
        
        PID:15040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22079.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32656.exe
        7⤵
        
        PID:9800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
        7⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28247.exe
        7⤵
        
        PID:17280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61907.exe
        6⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
        6⤵
        
        PID:12264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46036.exe
        6⤵
        
        PID:16568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe
        6⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57565.exe
        7⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19901.exe
        8⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        8⤵
        
        PID:13044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe
        8⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        7⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43475.exe
        7⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41196.exe
        7⤵
        
        PID:17400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41281.exe
        7⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
        7⤵
        
        PID:13796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51008.exe
        7⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        6⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60928.exe
        6⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5203.exe
        6⤵
        
        PID:16620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53879.exe
        5⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35639.exe
        6⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12582.exe
        6⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45581.exe
        6⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29584.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56103.exe
        5⤵
        
        PID:11880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        5⤵
        
        PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15971.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17529.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55904.exe
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26533.exe
        7⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48624.exe
        7⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60520.exe
        7⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32654.exe
        6⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5619.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        6⤵
        
        PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
        5⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54353.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        6⤵
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14670.exe
        5⤵
        
        PID:9324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10351.exe
        5⤵
        
        PID:13472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21493.exe
        5⤵
        
        PID:17256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60564.exe
      4⤵
      PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35121.exe
        5⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32677.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31629.exe
        7⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2023.exe
        7⤵
        
        PID:16200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46924.exe
        7⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
        6⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39931.exe
        6⤵
        
        PID:13760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8331.exe
        6⤵
        
        PID:17092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15115.exe
        5⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26253.exe
        6⤵
        
        PID:10148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
        6⤵
        
        PID:13460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65035.exe
        6⤵
        
        PID:16180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
        5⤵
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39740.exe
        5⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
        5⤵
        
        PID:17336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3990.exe
      4⤵
      PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        5⤵
        
        PID:11380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10714.exe
        5⤵
        
        PID:15748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3588.exe
        5⤵
        
        PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22831.exe
      4⤵
      PID:9376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27417.exe
      4⤵
      PID:11828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15527.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2588.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38909.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37669.exe
        6⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3294.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10928.exe
        8⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46401.exe
        8⤵
        
        PID:15748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28622.exe
        7⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44976.exe
        7⤵
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        7⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51923.exe
        6⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40072.exe
        6⤵
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15727.exe
        6⤵
        
        PID:15484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55136.exe
        5⤵
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62609.exe
        6⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        6⤵
        
        PID:14836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34289.exe
        6⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50195.exe
        5⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62817.exe
        6⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
        6⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2466.exe
        6⤵
        
        PID:17044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43476.exe
        5⤵
        
        PID:10376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61142.exe
        5⤵
        
        PID:13936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60076.exe
      4⤵
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        5⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
        6⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41281.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65035.exe
        7⤵
        
        PID:9516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28151.exe
        6⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7834.exe
        6⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8440.exe
        6⤵
        
        PID:15176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60424.exe
        5⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
        6⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
        6⤵
        
        PID:14800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        6⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        5⤵
        
        PID:11024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45360.exe
        5⤵
        
        PID:14956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44124.exe
        5⤵
        
        PID:844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
      4⤵
      PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4384.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59863.exe
        5⤵
        
        PID:12504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe
      4⤵
      PID:11768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44116.exe
      4⤵
      PID:16172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31758.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55437.exe
      4⤵
      PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62557.exe
        5⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52137.exe
        6⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        7⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22995.exe
        7⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2303.exe
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51259.exe
        6⤵
        
        PID:13412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41015.exe
        5⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
        6⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49525.exe
        7⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3656.exe
        6⤵
        
        PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11461.exe
        5⤵
        
        PID:9536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15790.exe
        5⤵
        
        PID:14068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65312.exe
        5⤵
        
        PID:1872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14295.exe
      4⤵
      PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        5⤵
        
        PID:8496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48624.exe
        5⤵
        
        PID:12984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36208.exe
        5⤵
        
        PID:17124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe
      4⤵
      PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57825.exe
        5⤵
        
        PID:12452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51592.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exe
      4⤵
      PID:6644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
    3⤵
    PID:1192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19723.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        5⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48624.exe
        5⤵
        
        PID:12916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60136.exe
        5⤵
        
        PID:15412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27119.exe
      4⤵
      PID:10168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
      4⤵
      PID:13064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48667.exe
      4⤵
      PID:17084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exe
    3⤵
    PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22584.exe
      4⤵
      PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
        5⤵
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
        5⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65035.exe
        5⤵
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35115.exe
      4⤵
      PID:11400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10714.exe
      4⤵
      PID:15652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45965.exe
      4⤵
      PID:4832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35522.exe
    3⤵
    PID:7712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16591.exe
    3⤵
    PID:12096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
    3⤵
    PID:15908
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28739.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28739.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23281.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12720.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15793.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3548.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14788.exe
        7⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6724.exe
        8⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29081.exe
        9⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
        9⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
        9⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8331.exe
        9⤵
        
        PID:17004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42655.exe
        8⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58903.exe
        8⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
        8⤵
        
        PID:15268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62676.exe
        7⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6856 -s 636
        8⤵
        Program crash
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17470.exe
        7⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        7⤵
        
        PID:13208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        7⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41731.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29745.exe
        7⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe
        8⤵
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44009.exe
        8⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33086.exe
        7⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        7⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24777.exe
        7⤵
        
        PID:14612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62099.exe
        6⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3248.exe
        7⤵
        
        PID:14704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10604.exe
        7⤵
        
        PID:16400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
        6⤵
        
        PID:12244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27780.exe
        6⤵
        
        PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56127.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41177.exe
        6⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42381.exe
        7⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
        7⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        7⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63609.exe
        7⤵
        
        PID:17916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
        6⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-316.exe
        7⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13728.exe
        7⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45360.exe
        6⤵
        
        PID:14976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33454.exe
        6⤵
        
        PID:17120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63910.exe
        5⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5454.exe
        6⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3621.exe
        6⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2235.exe
        5⤵
        
        PID:7752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
        5⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20159.exe
        5⤵
        
        PID:14024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31806.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8312.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37699.exe
        7⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21432.exe
        8⤵
        
        PID:11296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62516.exe
        8⤵
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5891.exe
        8⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45587.exe
        7⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45796.exe
        7⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21539.exe
        7⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32655.exe
        6⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        7⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10714.exe
        7⤵
        
        PID:15740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8331.exe
        7⤵
        
        PID:17072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45011.exe
        6⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18246.exe
        6⤵
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
        6⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        5⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        6⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
        7⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12163.exe
        7⤵
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        7⤵
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-331.exe
        6⤵
        
        PID:10568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64435.exe
        6⤵
        
        PID:13600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38373.exe
        6⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17029.exe
        5⤵
        
        PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21166.exe
        5⤵
        
        PID:11268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7914.exe
        5⤵
        
        PID:15728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe
        5⤵
        
        PID:16612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25814.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2007.exe
        5⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49101.exe
        6⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53201.exe
        7⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60388.exe
        7⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14443.exe
        7⤵
        
        PID:15788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38462.exe
        6⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12582.exe
        6⤵
        
        PID:12468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-848.exe
        6⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35291.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 720
        6⤵
        Program crash
        
        PID:10344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
        5⤵
        
        PID:10328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        5⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28932.exe
        5⤵
        
        PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-839.exe
      4⤵
      PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11208.exe
        5⤵
        
        PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35115.exe
        5⤵
        
        PID:11408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10714.exe
        5⤵
        
        PID:15708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4932.exe
        5⤵
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
      4⤵
      PID:7988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43321.exe
        5⤵
        
        PID:14492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
        5⤵
        
        PID:17388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61503.exe
      4⤵
      PID:11288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
      4⤵
      PID:15632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57295.exe
      4⤵
      PID:8504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15793.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34441.exe
        6⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37285.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41229.exe
        8⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8499.exe
        8⤵
        
        PID:10896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33874.exe
        8⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9255.exe
        8⤵
        
        PID:16844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33188.exe
        8⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        7⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45360.exe
        7⤵
        
        PID:13720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5603.exe
        6⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        7⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        7⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2466.exe
        7⤵
        
        PID:17100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3091.exe
        6⤵
        
        PID:10624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44202.exe
        6⤵
        
        PID:17112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58431.exe
        5⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19723.exe
        6⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62329.exe
        7⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12495.exe
        7⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        7⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
        6⤵
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39252.exe
        6⤵
        
        PID:11888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63718.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62329.exe
        6⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46061.exe
        7⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
        7⤵
        
        PID:17224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52463.exe
        6⤵
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41928.exe
        6⤵
        
        PID:17936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19879.exe
        5⤵
        
        PID:7172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
        5⤵
        
        PID:12760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16547.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22189.exe
        5⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14892.exe
        6⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22584.exe
        7⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24015.exe
        7⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
        7⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19924.exe
        7⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58800.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58903.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
        6⤵
        
        PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58592.exe
        5⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58328.exe
        6⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20382.exe
        7⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        6⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31642.exe
        5⤵
        
        PID:9300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        5⤵
        
        PID:11260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54159.exe
      4⤵
      PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34161.exe
        5⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13128.exe
        6⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49252.exe
        6⤵
        
        PID:11932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14443.exe
        6⤵
        
        PID:16352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-471.exe
        5⤵
        
        PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45727.exe
        5⤵
        
        PID:12084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
        5⤵
        
        PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29812.exe
      4⤵
      PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        5⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39128.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54377.exe
        6⤵
        
        PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe
        5⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40868.exe
        5⤵
        
        PID:16268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48355.exe
      4⤵
      PID:7908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38325.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11639.exe
      4⤵
      PID:14380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
        5⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4503.exe
        6⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13408.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
        7⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62732.exe
        7⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49096.exe
        6⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
        7⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
        7⤵
        
        PID:14724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40868.exe
        7⤵
        
        PID:16876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28622.exe
        6⤵
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe
        6⤵
        
        PID:15768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56376.exe
        6⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11747.exe
        5⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45033.exe
        6⤵
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20471.exe
        6⤵
        
        PID:12128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        6⤵
        
        PID:15684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        5⤵
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17753.exe
        6⤵
        
        PID:11812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10288.exe
        6⤵
        
        PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39030.exe
        5⤵
        
        PID:13576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45699.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56184.exe
      4⤵
      PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32381.exe
        5⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        6⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48624.exe
        6⤵
        
        PID:13120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        6⤵
        
        PID:17144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6366.exe
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33002.exe
        5⤵
        
        PID:10756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63801.exe
        5⤵
        
        PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16266.exe
      4⤵
      PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        5⤵
        
        PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        5⤵
        
        PID:12920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37605.exe
        5⤵
        
        PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63216.exe
      4⤵
      PID:8416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30202.exe
      4⤵
      PID:12532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
      4⤵
      PID:6152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11451.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50476.exe
      4⤵
      PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8364.exe
        5⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21121.exe
        6⤵
        
        PID:15492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        6⤵
        
        PID:14596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-331.exe
        5⤵
        
        PID:10560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
        5⤵
        
        PID:14440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13868.exe
        5⤵
        
        PID:16584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8622.exe
      4⤵
      PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6216.exe
        5⤵
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61727.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20063.exe
        5⤵
        
        PID:16848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
      4⤵
      PID:10556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36694.exe
      4⤵
      PID:14940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48008.exe
      4⤵
      PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48583.exe
    3⤵
    PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53481.exe
      4⤵
      PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38239.exe
      4⤵
      PID:10932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
      4⤵
      PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28861.exe
      4⤵
      PID:6360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49517.exe
      4⤵
      PID:15480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5176.exe
      4⤵
      PID:16628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11879.exe
    3⤵
    PID:11224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15694.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6927.exe
    3⤵
    PID:17964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7795.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5136.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41265.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39759.exe
        6⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54353.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-243.exe
        7⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        7⤵
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10890.exe
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58215.exe
        6⤵
        
        PID:12828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16488.exe
        6⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5359.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31992.exe
        6⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
        7⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
        7⤵
        
        PID:13444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe
        7⤵
        
        PID:16012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23875.exe
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63942.exe
        6⤵
        
        PID:13944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
        6⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        5⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
        6⤵
        
        PID:15592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
        6⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
        5⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8106.exe
        5⤵
        
        PID:15408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45076.exe
        5⤵
        
        PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-979.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe
        5⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54633.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25625.exe
        7⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25759.exe
        7⤵
        
        PID:14992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16171.exe
        7⤵
        
        PID:16536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54576.exe
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe
        6⤵
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3588.exe
        6⤵
        
        PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48364.exe
        5⤵
        
        PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        5⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45360.exe
        5⤵
        
        PID:14856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11695.exe
      4⤵
      PID:6656
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6656 -s 488
        5⤵
        Program crash
        
        PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42683.exe
      4⤵
      PID:8856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13667.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
      4⤵
      PID:5296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56375.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20845.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55904.exe
        5⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57285.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29725.exe
        7⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9260.exe
        7⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35691.exe
        6⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18527.exe
        6⤵
        
        PID:14736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32654.exe
        5⤵
        
        PID:8556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22147.exe
        5⤵
        
        PID:12964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5830.exe
      4⤵
      PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        5⤵
        
        PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19267.exe
        5⤵
        
        PID:12520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1763.exe
      4⤵
      PID:8512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59559.exe
      4⤵
      PID:13056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12411.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe
      4⤵
      PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19901.exe
        6⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        6⤵
        
        PID:13248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47884.exe
        6⤵
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2303.exe
        5⤵
        
        PID:10068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63284.exe
        5⤵
        
        PID:14532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38067.exe
        5⤵
        
        PID:16300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48992.exe
      4⤵
      PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57617.exe
        5⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
        5⤵
        
        PID:13788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64220.exe
        5⤵
        
        PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57071.exe
      4⤵
      PID:9720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18246.exe
      4⤵
      PID:15012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28932.exe
      4⤵
      PID:5136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61110.exe
    3⤵
    PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26533.exe
      4⤵
      PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        5⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22327.exe
        5⤵
        
        PID:17952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15403.exe
      4⤵
      PID:5356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23651.exe
    3⤵
    PID:8164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
      4⤵
      PID:15368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
    3⤵
    PID:11748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55987.exe
    3⤵
    PID:1108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8371.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8371.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44573.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57025.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        5⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        6⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25381.exe
        7⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        7⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56873.exe
        7⤵
        
        PID:1164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
        6⤵
        
        PID:9656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        6⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57720.exe
        6⤵
        
        PID:14408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62676.exe
        5⤵
        
        PID:6848
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6848 -s 632
        6⤵
        Program crash
        
        PID:9428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        5⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        5⤵
        
        PID:12992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65312.exe
        5⤵
        
        PID:15904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56184.exe
      4⤵
      PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47757.exe
        5⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
        6⤵
        
        PID:520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        6⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62884.exe
        5⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
        6⤵
        
        PID:15256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58903.exe
        5⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24393.exe
        5⤵
        
        PID:15264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2671.exe
      4⤵
      PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65209.exe
        5⤵
        
        PID:10088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
        6⤵
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45604.exe
        6⤵
        
        PID:16184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        6⤵
        
        PID:16600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11379.exe
        5⤵
        
        PID:11672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18527.exe
        5⤵
        
        PID:13624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
      4⤵
      PID:10112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55149.exe
      4⤵
      PID:14588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37295.exe
      4⤵
      PID:17312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49220.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
      4⤵
      PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49101.exe
        5⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        6⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64715.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38057.exe
        6⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe
        5⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57124.exe
        5⤵
        
        PID:13428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        5⤵
        
        PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35291.exe
      4⤵
      PID:6052
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6052 -s 624
        5⤵
        Program crash
        
        PID:8964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
      4⤵
      PID:13668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3142.exe
    3⤵
    PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
      4⤵
      PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54353.exe
        5⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45168.exe
        5⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28431.exe
      4⤵
      PID:9392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
      4⤵
      PID:12980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8331.exe
      4⤵
      PID:17052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30767.exe
    3⤵
    PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7560.exe
      4⤵
      PID:10844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
      4⤵
      PID:14792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65035.exe
      4⤵
      PID:14396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
    3⤵
    PID:9624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24139.exe
    3⤵
    PID:14124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
    3⤵
    PID:18172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15222.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15222.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38328.exe
        5⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13128.exe
        6⤵
        
        PID:8156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        6⤵
        
        PID:12932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45965.exe
        6⤵
        
        PID:14400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
        5⤵
        
        PID:9640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        5⤵
        
        PID:13212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe
        5⤵
        
        PID:15784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58592.exe
      4⤵
      PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe
        5⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1535.exe
        5⤵
        
        PID:13988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57744.exe
        5⤵
        
        PID:17060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29722.exe
      4⤵
      PID:9548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44009.exe
        5⤵
        
        PID:17320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
      4⤵
      PID:12044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
      4⤵
      PID:6384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37647.exe
    3⤵
    PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20425.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9864.exe
        5⤵
        
        PID:11336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62516.exe
        5⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31739.exe
        5⤵
        
        PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32811.exe
      4⤵
      PID:10964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33874.exe
      4⤵
      PID:14756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28861.exe
      4⤵
      PID:6160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58015.exe
    3⤵
    PID:7564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20014.exe
    3⤵
    PID:11100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36694.exe
    3⤵
    PID:14140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40992.exe
    3⤵
    PID:6756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10512.exe
    3⤵
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32656.exe
      4⤵
      PID:9792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
      4⤵
      PID:10344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40800.exe
      4⤵
      PID:7100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50528.exe
    3⤵
    PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41281.exe
      4⤵
      PID:9908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37523.exe
      4⤵
      PID:13404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
      4⤵
      PID:1588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe
    3⤵
    PID:10536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4763.exe
    3⤵
    PID:13612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
    3⤵
    PID:16864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36093.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36093.exe
  2⤵
  PID:1972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31805.exe
    3⤵
    PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62329.exe
      4⤵
      PID:8288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
      4⤵
      PID:12952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62301.exe
      4⤵
      PID:13400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
    3⤵
    PID:8624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40787.exe
    3⤵
    PID:13136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
    3⤵
    PID:7144
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
  2⤵
  PID:7032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
    3⤵
    PID:9784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15951.exe
    3⤵
    PID:12556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
    3⤵
    PID:17976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
  2⤵
  PID:9776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4751.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4751.exe
  2⤵
  PID:11460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49120.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49120.exe
  2⤵
  PID:5504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6656 -ip 6656
1⤵
PID:7404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 6856 -ip 6856
1⤵
PID:7856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6848 -ip 6848
1⤵
PID:8352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5476 -ip 5476
1⤵
PID:10908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 6052 -ip 6052
1⤵
PID:11024

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12455.exe

Filesize
468KB

MD5
30e0a4ac3c9c778c8cbb2d79a99744db

SHA1
4be220afe93ea744b96643ce90b8f25b93d6abaf

SHA256
ff67250677fdca62612a05af5c797f18bd2b7ae3a6103798ae6c747c0695f34c

SHA512
27db59546e4d793ebe180cbb94cf39e37f3dbce91ffc004b38c4207bf86943a8251c872ac19ae5b67be42e69815c68dd2d68663a647eff2f4a278a4ccbd16d01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12720.exe

Filesize
468KB

MD5
e08d46e8d8b71bf05aef5c88e23f2e79

SHA1
0f89da1b1296eefd7ae51ee681ee79e0dec28332

SHA256
b4accedc20126d14e1a8dbf2a7609c4b11ff86e0a96e22fc088ee831b3d1d84a

SHA512
8619007e72b56128e90e2f5880f94a694c567fe186bc71eeadac4d02d2d91b067e2eadfdd93e37063c5be190f04a193641f9ea3b2d6045c31b79bdc0803c3c0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe

Filesize
468KB

MD5
c4b65c9878fdd499a0af59f8742880d9

SHA1
05306a3df0b38d00d42b58536656eaa951d84ea4

SHA256
9ea38ff19a444a473dfba2fed41dd7353d70d70960f66f6c9399258fcc03a4ef

SHA512
d784430d7ea66cc0af09f9afa11163c695dec338a90a6ce2e8e73b168e835f77b5e55e668a0aa6f60645605ffc7fdf0a274de930b5319eaa4eed686dcabc383a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe

Filesize
468KB

MD5
f7e8dd8a9ed5fb52ccdb150acaad8be2

SHA1
28c5e713d26b528c8aafd1b8d9d33e09a7b2b231

SHA256
d4d1a6740fcf2bc421c1fe049bc2b0a19e621a18e85c28821fcf26c76a34ea3f

SHA512
66a0c0c6a0e91394c281c67d0e67d5859940e1ff3c4c0d7c909767ab1687145e974c14518a70b79d99358e516c2aaf6a5f62a0c0cb8060d1f8d949e1b511b630

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15222.exe

Filesize
468KB

MD5
e9eb8444d13e7b7714f5f56d725d4757

SHA1
25b712f7c36592363c7c649eef81672b6aa1cdc3

SHA256
a9acf83abbf7d136c9f2ab6ec71a28548be30ef5489ad2bb11f15733c4acda6c

SHA512
f32b52fee0e04dd911f5ef8b97c7eb7184747b7f731aaa2502e9535afa344aaf35fd0e446484cf0ced695e3e58112aa1867105b25ad9d74426785174b761c675

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15527.exe

Filesize
468KB

MD5
04243b79eb6058cf0a39787253e365d2

SHA1
59391b8885da88a2806684e9545d0dbd278a7dd9

SHA256
c6b3fb2863c36faa8bbc83cc0b908af6915a564e94acb291cc4fc4f18e0b2fa5

SHA512
a16232e64847a421b83605314e10e2cea57f50b860d2c1f9278ea3465c27a73f14708875c33c01cdcd0deee8c4f3b7e5ecb1091f2165cfe36bcd6f2a94820175

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15793.exe

Filesize
468KB

MD5
1b6540b0193bf1edb9cef200c9d06bea

SHA1
b74fe4f57e44a41e0bbf67e67ae96fa4dacf198f

SHA256
c4ffee165a8ab93db5513037aa12d41b763931f719be049d262c0650ae0dccb9

SHA512
28e9798f737d5befc0fe3b69b287501259a5c8a597698fe50372593d6141850f12295ebe45c118997cefc4d695e8ef6181fd3fa1f8524a90f48498d98011ebe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17521.exe

Filesize
468KB

MD5
992b772043057e98baafe9f09bd1c7ea

SHA1
80c941e85ff954c1cd8edb3adc6b53d567c9f145

SHA256
737a0e5f006d4083d3d4fa464d3b01e54c2bbe972c38abad8c05ef1a052e9fc5

SHA512
842c8ccfb7f4db185002f3a2d3bc3891fc49980035eda1c3e16bb13c905a1dfcc43ae011aa5b7651547f0ed5651a5e71e2877e046a42ed3aaa98c954ffdd8d47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe

Filesize
468KB

MD5
b03ef5dd78727730f3da748dcc1b2531

SHA1
49d418ceb4bcb99539ad742bf2c66b66a245fd4f

SHA256
572afda2729d2a470c373990d34b63924c307c8a40194c433c4d27361563ac92

SHA512
ceaa2e3451dc98438831f31254a2d7da3cbdb5e297c14cc084a45148e70cb84e6a027ded65a2e4f773c825635336528b1a9f79bae8df0e8e2ef64f17245f108e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe

Filesize
468KB

MD5
86c0ad43bc1ae8a4feff4d96c6aec09b

SHA1
124d33a3f09c7a23760df5210f3e65fa3cc77d38

SHA256
200fb19269875500bd3ae5bfa43c0b987831584c2db22bafa7c4cac360853780

SHA512
ba8be43ee0b1f9240cb9f5aa1418bd143fdf9df293284e71ba58694430b58ca5c0bad25c69072f69a6beeda2d5d681a25254926b984287e543e00adc6020007b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23281.exe

Filesize
468KB

MD5
7e6c7676d1d0f485e6acb3a8659d5414

SHA1
4fcf5d4ab9f4ebb3cfda8ccc49f62009c74d3e66

SHA256
0ed67f8caeae63268d6914692bcc33b191ce610b3af5408672d3e95be28b75c5

SHA512
3dbb2a680041a927521e0ec6f1657b55ed74369962e85a7691f429c7575565b117e583673cea1ba280a6aef5d1264030bd291ced542277ae8a50b8ef657ddcd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-243.exe

Filesize
468KB

MD5
de3d61c8c162ffa2a468310643f8bafb

SHA1
81cf8ad263465f6ef9640d1f13a25f5811d7a616

SHA256
586e3b17c454e20530dc940ba60fa5cddda96bfb26904be05a891a2cc3b8f40c

SHA512
418627adb65b2ca5206ee67b5a3e4895ebb7aba4add0d581994030f7a50d49756908e516855661664ef1e2b9bfdcd2a5824217d4b4336a9271ca9b8634eb56a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25144.exe

Filesize
468KB

MD5
a8a4b7fe618103598ae487d996958f14

SHA1
5bc89f8be5b73943aceeb50be2f2d1792076ca04

SHA256
1fe6cfca7ff7ac66b06cd1015532f3151f8cf84da0ced6811469a47764bded3f

SHA512
8125136a96ceba8fad6292d71cc4e83708051d38210c31a6f7b33367a82f357e2b07c10fdce1355697cd44da7fa1f95677f5fb0871216a7b296cb9186963ce4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26190.exe

Filesize
468KB

MD5
1ad06076d1592b2570fc0259c099d8cb

SHA1
6bd245a27cdd805399460e604e6499f3fa26e33d

SHA256
5c4b58f524c7ad5656947d9a464227f1ebdc0c6432c1d38776c648aeccf56d45

SHA512
ebd4a4828809c0db1770e96f493c3dd5d9945dcfae852177e41527d27436cd390f4be9c7ba7673789f441c2304306bd7e95d9ef548a50273ede59eddf1ab9549

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28739.exe

Filesize
468KB

MD5
c4d9802912036b1e147b322dc015b10c

SHA1
c132c485c8e5dc470667779b2695708e49c077de

SHA256
aacbcf19bde9dcf1a974e434a3f1ec23d174d4a0fe99c3b9f770605f33a69050

SHA512
fe7162d3f17aa6304bf32c54fff735726539dceda359f60c320760a2603c4c47ceedd6dea78b5919d1d924dc7c2e4a3049a6d37d7f705163a6fc4afafe77f7af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe

Filesize
468KB

MD5
1276d036e6639cf2930af625df6802a0

SHA1
706ecced47b1f25f63f425bcf241085af7fcedc6

SHA256
90acda693ff70088374d86384a4c7a9407e5d68719ce9245b0b3059035015622

SHA512
b89733f544364d5fd853fd71b2b66cd5f3d571818776592e40b4ed5b9b7cd33c6f7879e72f99e37cfa35c3fcfecaeb1568a3850a3293fe508bf976d4dabedef9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31806.exe

Filesize
468KB

MD5
80fe705b05487a889d420337b0be7b59

SHA1
a1e2db8f84e73e34e72ca438afe2342fb40e4fe5

SHA256
19e2b1c92064474a919df117c32479cb4257fa52d3ccf8ce37f1779ed3b28c51

SHA512
c2f39cc90491bd36c0fec97a7c1e6bc2eec55ea69f5291bd5f4f823a8449f849cc568628fb9ec93b2c86f046f83ba03ff7ff786a42b559c4b39120d449c130a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32513.exe

Filesize
468KB

MD5
37eb344252043ba8e572b399901f3158

SHA1
728f95932b1077357c7139fea7ae402ff3c87bd0

SHA256
fd8c1ff21c1db9edfe60363b6799aeb53cd6a28286cda7763010e52c06832d19

SHA512
10c5f4bd316966659dc405b509ae9c5c39f37ab040e4a48c165ebcf93d0efc936788276922e6297584c812d509c238e00c92cf7d3e0c2c047d7cb2929873e703

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33188.exe

Filesize
468KB

MD5
6e1a348bd60851cc82b0c88332d8a000

SHA1
4bea146671f28cc67be4f1f1a8aca3bd4f266758

SHA256
9b2163d3c47826470d030d90046b3388ca65b43ca05cd53a612d32b2f446285f

SHA512
e91c07ec55c70842695b1ada8f0316fbdb97ebc1e423977a4a6da9590c43c1ecc7a75dcca474fa44e68d655208f0c2152f4897bfa4a7430fa91e2a8aa3125576

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe

Filesize
468KB

MD5
e49a8aec12c7881bbff61842a4c4fbb7

SHA1
9682418df2549582db0e340b81d9edee9aab24ab

SHA256
71331a9dbb95933a00375d8aa472c8bccab0160fcc13eea28fe10746e8307bda

SHA512
5e348830ff646300ee64d08ed61465f1b7f787d54384bacbe2d033187e23285fd29da4c8aa79627c822b66987f808c7a800522b33d6697dc6f451f5de3d8a22a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44573.exe

Filesize
468KB

MD5
2713663e691b6071f253f7f7b464c250

SHA1
d3b0d1f6d9ec9eb844e82743867a7d67b2f019d2

SHA256
cac200ff17089666fc6929ca672f44875dfb3fb70cad9be6d3ed901caa34b51b

SHA512
9c615cfb018b564df973dd248d6fe39dfa47990ce0eb2bbcdc89ddf056a088f2dd6faeaf7ac9eba1068a97e86d4cda5e97177a4bd42a884403bd549085271fa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48657.exe

Filesize
468KB

MD5
095f1bf66d285b7d611496c00a009949

SHA1
fb95b788cae54ce95a7e9529950eb84e78d546e8

SHA256
08c79854b135c92ed5fbca99402d68a6ca7d8d9bf7bf683279ce7ab96b5aaf06

SHA512
86f8d542b8885ba405f44781b6096effb74f71e4fcad1d3f472607447aa73cbd19b5eab7649969d03df195a726e978dabc1d965ee1032d7f2e4a1cd76b8c9a07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5136.exe

Filesize
468KB

MD5
a18268dd80d1e8295fc9acd0c7e5bc8c

SHA1
8819bccb990dc0570c084d4a46d69e8d45ba4cfe

SHA256
5edbd2ea48526817dbc1955a6cac5e5055d69fdcceece73a3536d9c9cc532c7a

SHA512
b2406cceb5f7c0bd8230503a48dc9aaa42cf973b3ea46eeb8138f85e69fed61fda36fe8c34bc79dd6435ef789a507470ddb9b8870655f658befea92fe534caf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51576.exe

Filesize
468KB

MD5
ff1dbc84eb36af22daacc7f41426fa1f

SHA1
dcfacea9acd996156d4ab83e56275d9ec5c9ed1f

SHA256
332d9fb0380d532213dbfa62897af9832241b097df6325596f95e8e2c40d3031

SHA512
645cc363e9bccd501ecc2e8f3f3e067e7d8570b434b276b16a2274f9c7714f8e705ae02242145a208fa0eca86608cfa804806a84ed334e670eece01f2053bf84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe

Filesize
468KB

MD5
8aeb61dd15d6804a658273ae9b110706

SHA1
031aeb8825af52b70cfb8cd3f1a1052711dfd61c

SHA256
6ece1e722d63621c4e8bcd79ce945f5a36b1ac24758cddbccca81f9b4ae1c792

SHA512
535b35f91d129c29325110a5846670e1f37a2b32e6905d03642824ecac8839820c16032373d972e10674c54ab7affd02725f3eed5018ebc5a2cc78c8d2989203

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe

Filesize
468KB

MD5
504f4c4aa119a97ec57e23b91079afa4

SHA1
bd7e36e43a6aeb10a900fe232975e5c623c89f14

SHA256
2e4e82d9e54975138f04c250673be6f8a7d2ac01f62e73bfefad562939f85ce0

SHA512
289d8e87e72fc721b307125179e8939a6039925308674b4ec9bd5d8341c729c6d084bc0424ecfa1a61560d94f694d12d2d4caaa7b41ffdcb427b65dcaad0dbfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56375.exe

Filesize
468KB

MD5
c62911421e9eff6208f42c3041d6574b

SHA1
e52b7f3ee512cb465ded6a0d4e4fd795f64e7896

SHA256
051c14e5c8a58daaa1bc567b15ec9db5322c7b3edac53314684b78c273405799

SHA512
692d0f4f7eb5920f2311a418d536afdbe3112955959fc58c1d67d6805e3394840b84965daa2c7e7cacae311f51db89ab46ec38b9bc1f7f8bc1f948dac4a8162a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe

Filesize
468KB

MD5
760e39834125f09ddc1cec09b4c2edcb

SHA1
064e9260c98d76c5defa34346459a954dc6d6b4e

SHA256
63e440a205c59fc0992eb6408161c5a7979805dcd7c36d785c8e75d9553cd2bc

SHA512
72574a248033fb80764cec4b935836a0c797c980f6d0441fc0cd43d07d5dbee1b9ed8f6eef506bf5ef50ddc0745199f6a0d91eb2956a6031d74188b7d49f5709

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe

Filesize
468KB

MD5
10e65c2dc7c17d09a5420a4d30a6ae4f

SHA1
cba351364597cfbee66da82370acfac63fe26cfb

SHA256
1da4ea890c98acfdd437454027e65818b4fb7f9fe5bedb0dc3adc3ecbf450e90

SHA512
c34970187003ca68a7742bed4980dda4f78ed6d517d0c6b77b1f2ce8b8ddd76814aab822f3a6ed01eb6c6de4c8c3e64fc4af4d188c1b0b84e7f16275bbb0f85d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6590.exe

Filesize
468KB

MD5
5335bbd20836181cd0a9ed7106345291

SHA1
41a3a10a17815d8c882b87d4a9399d054376051d

SHA256
2a249c712dc0bbeb508ed0ab6fa395b1d358cefb65c4a13497f831aa4cc6b01e

SHA512
35772acf18fed632b012a14821631aa5a76231baf49c19b2c78074321b1b306e2ed5e973218ac51cd11a0721d1fe30d31ce563381148e3d4a1a44f58257a4555

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7795.exe

Filesize
468KB

MD5
e32fe3d724da5998b2590db293d27070

SHA1
d44eda1d4950a46b4e3cf3f31e3df97b18ea2a77

SHA256
3559279d6b8d8d6ca7de87003c115a37c50ed7dad1b65fad297259a2510fcbc1

SHA512
4bca95770527a73718e81ae40a419464b047033bf9826c47df5cc20ef7502538e586d91ccc8baef333417f3fc4a31013a52a48ad13760192065ba742c0f07def

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8371.exe

Filesize
468KB

MD5
97b24c09f75bb8b052f1b1c847adc412

SHA1
ab8a072e90bcfbcb48ede48d09ab698972d9b4c7

SHA256
ea9fc9c2010654fe147c0f2937cee27e3993f636b8ebdef210b2b39d8b950e3a

SHA512
efa60ad9864b3e335567366671e278389327748158b6947429a32922b7b542381a9883931e3063198901d5234c97035a6269df3f9aeb63be2b6b588412a5682c

Download Submit
memory/220-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/232-480-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/388-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/444-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/456-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/472-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/592-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/740-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/772-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/952-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1128-66-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1192-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1204-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1208-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1428-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1480-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1544-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1596-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1708-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1736-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1764-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1812-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1828-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1840-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1844-453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1944-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1972-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1992-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1996-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2144-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2176-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2308-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2388-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2412-165-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2452-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2632-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2772-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2924-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2964-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3032-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3124-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3224-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3232-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3236-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3344-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3468-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3524-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3564-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3576-68-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3600-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3608-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3624-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3852-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3888-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3988-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3992-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4092-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4124-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4144-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4356-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4416-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4428-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4512-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4532-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4540-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4704-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4720-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4792-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4804-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4808-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4884-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4892-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4932-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4940-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4964-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4984-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4988-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5108-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5176-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5188-550-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5212-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5220-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5248-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5288-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads