0084ea790177bdafc207a50c23451772f8ed1500d46054b02445dae5ca03b9f9

Analysis

max time kernel
85s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
0084ea790177bdafc207a50c23451772f8ed1500d46054b02445dae5ca03b9f9N.exe
Size 468KB
Sample241002-tglrfaydkb
SHA256 0084ea790177bdafc207a50c23451772f8ed1500d46054b02445dae5ca03b9f9
MD5 39472854bde7c2b0a70848935c4de670
SHA1 bbe9db65fb7d14024870c4db144ed533569683d4
SHA512 79326cbb7b29fa64864e2fbea4591e8ecf9f32a258813f1d971015614442013463676e0e372d55b4438e32b073cf92abf6e2bac5b74a16a7aa08fc6675ffa9c3
SSDEEP 3072:dFmnog2/028U2bYoPzByqf8/0Dhj5IpUEpHGvozstkX+9krSWJl5:dFWo0XU2TPlyqfP0EztkOirSW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2288	Unicorn-36427.exe
2000	Unicorn-17735.exe
1880	Unicorn-10121.exe
1244	Unicorn-40651.exe
4724	Unicorn-47733.exe
4704	Unicorn-38081.exe
3280	Unicorn-53863.exe
1384	Unicorn-11398.exe
5080	Unicorn-65238.exe
1572	Unicorn-43495.exe
4004	Unicorn-57785.exe
2296	Unicorn-2654.exe
2604	Unicorn-6738.exe
2196	Unicorn-6473.exe
1788	Unicorn-64662.exe
4484	Unicorn-26531.exe
3312	Unicorn-27277.exe
1960	Unicorn-14470.exe
3420	Unicorn-20592.exe
4228	Unicorn-50651.exe
1772	Unicorn-13894.exe
3592	Unicorn-59566.exe
464	Unicorn-47314.exe
1588	Unicorn-1642.exe
3744	Unicorn-5653.exe
3940	Unicorn-63095.exe
4388	Unicorn-5156.exe
3384	Unicorn-59758.exe
4088	Unicorn-56965.exe
1204	Unicorn-33171.exe
4076	Unicorn-21473.exe
3316	Unicorn-48931.exe
3340	Unicorn-477.exe
1952	Unicorn-15172.exe
1916	Unicorn-12750.exe
3680	Unicorn-29279.exe
1780	Unicorn-42277.exe
3456	Unicorn-46362.exe
4028	Unicorn-29471.exe
1964	Unicorn-3688.exe
4708	Unicorn-34515.exe
2592	Unicorn-59019.exe
2320	Unicorn-59019.exe
1684	Unicorn-17913.exe
1904	Unicorn-6481.exe
4920	Unicorn-26347.exe
2588	Unicorn-21692.exe
2148	Unicorn-42875.exe
3100	Unicorn-62719.exe
4032	Unicorn-46938.exe
244	Unicorn-41337.exe
1712	Unicorn-5350.exe
5020	Unicorn-13518.exe
1108	Unicorn-11472.exe
4792	Unicorn-30047.exe
4444	Unicorn-18349.exe
4648	Unicorn-32084.exe
3276	Unicorn-42034.exe
1136	Unicorn-6310.exe
3760	Unicorn-16516.exe
64	Unicorn-27477.exe
4924	Unicorn-15438.exe
3096	Unicorn-19523.exe
1848	Unicorn-17476.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
5276	3680	WerFault.exe	124
6800	5912	WerFault.exe	236
8124	244	WerFault.exe	139
8156	5908	WerFault.exe	222
7784	2160	WerFault.exe	238
8188	244	WerFault.exe	139
14324	13120	WerFault.exe	635

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37987.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61334.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2924	0084ea790177bdafc207a50c23451772f8ed1500d46054b02445dae5ca03b9f9N.exe
2288	Unicorn-36427.exe
1880	Unicorn-10121.exe
2000	Unicorn-17735.exe
1244	Unicorn-40651.exe
3280	Unicorn-53863.exe
4704	Unicorn-38081.exe
4724	Unicorn-47733.exe
1384	Unicorn-11398.exe
1572	Unicorn-43495.exe
5080	Unicorn-65238.exe
1788	Unicorn-64662.exe
4004	Unicorn-57785.exe
2296	Unicorn-2654.exe
2604	Unicorn-6738.exe
2196	Unicorn-6473.exe
4484	Unicorn-26531.exe
3312	Unicorn-27277.exe
3420	Unicorn-20592.exe
1960	Unicorn-14470.exe
4228	Unicorn-50651.exe
1772	Unicorn-13894.exe
3592	Unicorn-59566.exe
4088	Unicorn-56965.exe
1588	Unicorn-1642.exe
3744	Unicorn-5653.exe
3384	Unicorn-59758.exe
464	Unicorn-47314.exe
4388	Unicorn-5156.exe
3940	Unicorn-63095.exe
1204	Unicorn-33171.exe
4076	Unicorn-21473.exe
3316	Unicorn-48931.exe
3340	Unicorn-477.exe
1952	Unicorn-15172.exe
1916	Unicorn-12750.exe
3680	Unicorn-29279.exe
1780	Unicorn-42277.exe
4028	Unicorn-29471.exe
3456	Unicorn-46362.exe
1964	Unicorn-3688.exe
4708	Unicorn-34515.exe
2592	Unicorn-59019.exe
2320	Unicorn-59019.exe
1684	Unicorn-17913.exe
4920	Unicorn-26347.exe
2148	Unicorn-42875.exe
2588	Unicorn-21692.exe
3100	Unicorn-62719.exe
1904	Unicorn-6481.exe
244	Unicorn-41337.exe
1712	Unicorn-5350.exe
4648	Unicorn-32084.exe
1108	Unicorn-11472.exe
4792	Unicorn-30047.exe
5020	Unicorn-13518.exe
4032	Unicorn-46938.exe
4444	Unicorn-18349.exe
1136	Unicorn-6310.exe
3760	Unicorn-16516.exe
64	Unicorn-27477.exe
1692	Unicorn-15365.exe
1848	Unicorn-17476.exe
4260	Unicorn-32521.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2288	2924	0084ea790177bdafc207a50c23451772f8ed1500d46054b02445dae5ca03b9f9N.exe	82
PID 2924 wrote to memory of 2288	2924	0084ea790177bdafc207a50c23451772f8ed1500d46054b02445dae5ca03b9f9N.exe	82
PID 2924 wrote to memory of 2288	2924	0084ea790177bdafc207a50c23451772f8ed1500d46054b02445dae5ca03b9f9N.exe	82
PID 2288 wrote to memory of 2000	2288	Unicorn-36427.exe	85
PID 2288 wrote to memory of 2000	2288	Unicorn-36427.exe	85
PID 2288 wrote to memory of 2000	2288	Unicorn-36427.exe	85
PID 2924 wrote to memory of 1880	2924	0084ea790177bdafc207a50c23451772f8ed1500d46054b02445dae5ca03b9f9N.exe	86
PID 2924 wrote to memory of 1880	2924	0084ea790177bdafc207a50c23451772f8ed1500d46054b02445dae5ca03b9f9N.exe	86
PID 2924 wrote to memory of 1880	2924	0084ea790177bdafc207a50c23451772f8ed1500d46054b02445dae5ca03b9f9N.exe	86
PID 1880 wrote to memory of 1244	1880	Unicorn-10121.exe	89
PID 1880 wrote to memory of 1244	1880	Unicorn-10121.exe	89
PID 1880 wrote to memory of 1244	1880	Unicorn-10121.exe	89
PID 2924 wrote to memory of 4724	2924	0084ea790177bdafc207a50c23451772f8ed1500d46054b02445dae5ca03b9f9N.exe	90
PID 2924 wrote to memory of 4724	2924	0084ea790177bdafc207a50c23451772f8ed1500d46054b02445dae5ca03b9f9N.exe	90
PID 2924 wrote to memory of 4724	2924	0084ea790177bdafc207a50c23451772f8ed1500d46054b02445dae5ca03b9f9N.exe	90
PID 2288 wrote to memory of 4704	2288	Unicorn-36427.exe	91
PID 2288 wrote to memory of 4704	2288	Unicorn-36427.exe	91
PID 2288 wrote to memory of 4704	2288	Unicorn-36427.exe	91
PID 2000 wrote to memory of 3280	2000	Unicorn-17735.exe	92
PID 2000 wrote to memory of 3280	2000	Unicorn-17735.exe	92
PID 2000 wrote to memory of 3280	2000	Unicorn-17735.exe	92
PID 3280 wrote to memory of 1384	3280	Unicorn-53863.exe	96
PID 3280 wrote to memory of 1384	3280	Unicorn-53863.exe	96
PID 3280 wrote to memory of 1384	3280	Unicorn-53863.exe	96
PID 2000 wrote to memory of 5080	2000	Unicorn-17735.exe	97
PID 2000 wrote to memory of 5080	2000	Unicorn-17735.exe	97
PID 2000 wrote to memory of 5080	2000	Unicorn-17735.exe	97
PID 4704 wrote to memory of 1572	4704	Unicorn-38081.exe	98
PID 4704 wrote to memory of 1572	4704	Unicorn-38081.exe	98
PID 4704 wrote to memory of 1572	4704	Unicorn-38081.exe	98
PID 2288 wrote to memory of 4004	2288	Unicorn-36427.exe	99
PID 2288 wrote to memory of 4004	2288	Unicorn-36427.exe	99
PID 2288 wrote to memory of 4004	2288	Unicorn-36427.exe	99
PID 4724 wrote to memory of 2296	4724	Unicorn-47733.exe	100
PID 4724 wrote to memory of 2296	4724	Unicorn-47733.exe	100
PID 4724 wrote to memory of 2296	4724	Unicorn-47733.exe	100
PID 1244 wrote to memory of 2604	1244	Unicorn-40651.exe	101
PID 1244 wrote to memory of 2604	1244	Unicorn-40651.exe	101
PID 1244 wrote to memory of 2604	1244	Unicorn-40651.exe	101
PID 2924 wrote to memory of 2196	2924	0084ea790177bdafc207a50c23451772f8ed1500d46054b02445dae5ca03b9f9N.exe	102
PID 2924 wrote to memory of 2196	2924	0084ea790177bdafc207a50c23451772f8ed1500d46054b02445dae5ca03b9f9N.exe	102
PID 2924 wrote to memory of 2196	2924	0084ea790177bdafc207a50c23451772f8ed1500d46054b02445dae5ca03b9f9N.exe	102
PID 1880 wrote to memory of 1788	1880	Unicorn-10121.exe	103
PID 1880 wrote to memory of 1788	1880	Unicorn-10121.exe	103
PID 1880 wrote to memory of 1788	1880	Unicorn-10121.exe	103
PID 1384 wrote to memory of 4484	1384	Unicorn-11398.exe	104
PID 1384 wrote to memory of 4484	1384	Unicorn-11398.exe	104
PID 1384 wrote to memory of 4484	1384	Unicorn-11398.exe	104
PID 3280 wrote to memory of 3312	3280	Unicorn-53863.exe	105
PID 3280 wrote to memory of 3312	3280	Unicorn-53863.exe	105
PID 3280 wrote to memory of 3312	3280	Unicorn-53863.exe	105
PID 1788 wrote to memory of 1960	1788	Unicorn-64662.exe	106
PID 1788 wrote to memory of 1960	1788	Unicorn-64662.exe	106
PID 1788 wrote to memory of 1960	1788	Unicorn-64662.exe	106
PID 1880 wrote to memory of 3420	1880	Unicorn-10121.exe	107
PID 1880 wrote to memory of 3420	1880	Unicorn-10121.exe	107
PID 1880 wrote to memory of 3420	1880	Unicorn-10121.exe	107
PID 1572 wrote to memory of 4228	1572	Unicorn-43495.exe	108
PID 1572 wrote to memory of 4228	1572	Unicorn-43495.exe	108
PID 1572 wrote to memory of 4228	1572	Unicorn-43495.exe	108
PID 5080 wrote to memory of 1772	5080	Unicorn-65238.exe	109
PID 5080 wrote to memory of 1772	5080	Unicorn-65238.exe	109
PID 5080 wrote to memory of 1772	5080	Unicorn-65238.exe	109
PID 4704 wrote to memory of 3592	4704	Unicorn-38081.exe	110

C:\Users\Admin\AppData\Local\Temp\0084ea790177bdafc207a50c23451772f8ed1500d46054b02445dae5ca03b9f9N.exe
"C:\Users\Admin\AppData\Local\Temp\0084ea790177bdafc207a50c23451772f8ed1500d46054b02445dae5ca03b9f9N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36427.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36427.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17735.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53863.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11398.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26531.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33171.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14582.exe
        9⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37987.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44287.exe
        11⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
        11⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
        10⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14768.exe
        10⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56394.exe
        10⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12257.exe
        9⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18263.exe
        10⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27560.exe
        10⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
        9⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        9⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        8⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63835.exe
        9⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exe
        10⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        10⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
        9⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
        9⤵
        
        PID:14764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        8⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
        9⤵
        
        PID:12676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61874.exe
        9⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55174.exe
        8⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65357.exe
        8⤵
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27477.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14198.exe
        8⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25735.exe
        9⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13565.exe
        10⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
        10⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38357.exe
        10⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49414.exe
        9⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44893.exe
        9⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        8⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52227.exe
        9⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
        8⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        8⤵
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6480.exe
        7⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
        8⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23727.exe
        9⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
        9⤵
        
        PID:12860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46674.exe
        8⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38993.exe
        8⤵
        
        PID:13864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56746.exe
        7⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44529.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20142.exe
        7⤵
        
        PID:16000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21473.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54286.exe
        7⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34375.exe
        8⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50343.exe
        9⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11386.exe
        10⤵
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32517.exe
        10⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4245.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16408.exe
        9⤵
        
        PID:15624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40949.exe
        8⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19467.exe
        9⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27692.exe
        8⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14176.exe
        7⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        8⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        8⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37048.exe
        7⤵
        
        PID:13612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41213.exe
        6⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe
        7⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58651.exe
        9⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        9⤵
        
        PID:13096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32885.exe
        8⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8136.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34578.exe
        8⤵
        
        PID:15316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64198.exe
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33566.exe
        7⤵
        
        PID:14800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36658.exe
        6⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8386.exe
        7⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe
        7⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
        7⤵
        
        PID:15352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56353.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9081.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27277.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48931.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19523.exe
        7⤵
        Executes dropped EXE
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18381.exe
        9⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33426.exe
        9⤵
        
        PID:15436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40949.exe
        8⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28416.exe
        8⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60637.exe
        7⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31371.exe
        8⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28558.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
        7⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        7⤵
        
        PID:15988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32521.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47063.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37411.exe
        8⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23727.exe
        9⤵
        
        PID:10308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        9⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        8⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        8⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe
        7⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
        7⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        7⤵
        
        PID:14676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43237.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29923.exe
        7⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
        7⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34272.exe
        7⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        6⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25616.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15172.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3378.exe
        6⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 460
        8⤵
        Program crash
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57478.exe
        7⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        7⤵
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27692.exe
        7⤵
        
        PID:16084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44058.exe
        6⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37235.exe
        7⤵
        
        PID:12824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8364.exe
        6⤵
        
        PID:8840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46561.exe
        6⤵
        
        PID:13404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23033.exe
        6⤵
        
        PID:16060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15365.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe
        6⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40919.exe
        7⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44649.exe
        7⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        7⤵
        
        PID:14684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23357.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
        6⤵
        
        PID:11852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        6⤵
        
        PID:15944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7764.exe
        5⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18875.exe
        7⤵
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30109.exe
        7⤵
        
        PID:14548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2236.exe
        6⤵
        
        PID:14000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26654.exe
        6⤵
        
        PID:15524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28421.exe
        5⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52507.exe
        6⤵
        
        PID:10968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31069.exe
        6⤵
        
        PID:14516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20788.exe
        6⤵
        
        PID:14664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38871.exe
        5⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        5⤵
        
        PID:15096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65238.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13894.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12750.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39943.exe
        7⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
        8⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe
        9⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38261.exe
        9⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
        9⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38357.exe
        9⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44842.exe
        8⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29036.exe
        8⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58651.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        8⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57373.exe
        7⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        7⤵
        
        PID:12496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20077.exe
        6⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26015.exe
        7⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21755.exe
        8⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38261.exe
        8⤵
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
        8⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24613.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        7⤵
        
        PID:13360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exe
        7⤵
        
        PID:15944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54249.exe
        6⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        7⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36741.exe
        7⤵
        
        PID:15836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51562.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
        6⤵
        
        PID:12748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42277.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49071.exe
        6⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38267.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        8⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18381.exe
        8⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
        8⤵
        
        PID:16332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57478.exe
        7⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        7⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
        7⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60637.exe
        6⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20323.exe
        7⤵
        
        PID:13228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        6⤵
        
        PID:9588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19280.exe
        6⤵
        
        PID:13928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30880.exe
        5⤵
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17463.exe
        6⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57587.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exe
        8⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        8⤵
        
        PID:12744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57146.exe
        7⤵
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56097.exe
        7⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe
        6⤵
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20057.exe
        6⤵
        
        PID:13184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26902.exe
        5⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9466.exe
        6⤵
        
        PID:11744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9648.exe
        5⤵
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
        5⤵
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26879.exe
        5⤵
        
        PID:15448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30047.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42543.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50343.exe
        8⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31127.exe
        9⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        9⤵
        
        PID:14628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13565.exe
        8⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
        8⤵
        
        PID:16116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36865.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7272.exe
        7⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16777.exe
        6⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37375.exe
        7⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37701.exe
        7⤵
        
        PID:14044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29168.exe
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45714.exe
        6⤵
        
        PID:13600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
        6⤵
        
        PID:15416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        5⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7338.exe
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        6⤵
        
        PID:14276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        5⤵
        
        PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37982.exe
        5⤵
        
        PID:11040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42034.exe
      4⤵
      Executes dropped EXE
      PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1178.exe
        5⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21651.exe
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
        7⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25257.exe
        7⤵
        
        PID:13656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40477.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20580.exe
        6⤵
        
        PID:14048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4089.exe
        5⤵
        
        PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36865.exe
        5⤵
        
        PID:10824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24822.exe
        5⤵
        
        PID:15244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60089.exe
      4⤵
      PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26119.exe
        5⤵
        
        PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
        5⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
        5⤵
        
        PID:14756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7041.exe
      4⤵
      PID:7236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18258.exe
      4⤵
      PID:10984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23744.exe
      4⤵
      PID:15020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38081.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43495.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50651.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59019.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
        7⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21163.exe
        8⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8386.exe
        9⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61422.exe
        9⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
        9⤵
        
        PID:13944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exe
        9⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44074.exe
        8⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61089.exe
        8⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exe
        8⤵
        
        PID:14868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        7⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        8⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55735.exe
        9⤵
        
        PID:12816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9289.exe
        8⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50601.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe
        7⤵
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17988.exe
        7⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        6⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52927.exe
        8⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe
        9⤵
        
        PID:14204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51910.exe
        8⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        8⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26654.exe
        8⤵
        
        PID:15776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10633.exe
        7⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32116.exe
        7⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exe
        7⤵
        
        PID:14520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-965.exe
        6⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exe
        7⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        7⤵
        
        PID:14740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17773.exe
        6⤵
        
        PID:14300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
        6⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46155.exe
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35787.exe
        8⤵
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39045.exe
        8⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20788.exe
        8⤵
        
        PID:13960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        7⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53253.exe
        7⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe
        6⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
        6⤵
        
        PID:11908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43157.exe
        6⤵
        
        PID:16024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10564.exe
        5⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37603.exe
        6⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37759.exe
        7⤵
        
        PID:10132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
        7⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56517.exe
        6⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        6⤵
        
        PID:14584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14753.exe
        5⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5522.exe
        6⤵
        
        PID:13520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
        5⤵
        
        PID:10560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20425.exe
        5⤵
        
        PID:14788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59566.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29471.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44987.exe
        6⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17463.exe
        7⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26415.exe
        8⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18381.exe
        8⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38017.exe
        7⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12272.exe
        7⤵
        
        PID:12568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7301.exe
        6⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16571.exe
        7⤵
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23373.exe
        7⤵
        
        PID:14312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
        6⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
        6⤵
        
        PID:12612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe
        6⤵
        
        PID:15628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38141.exe
        5⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49367.exe
        6⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42175.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4245.exe
        7⤵
        
        PID:11648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16408.exe
        7⤵
        
        PID:15632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        6⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12730.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        6⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2996.exe
        6⤵
        
        PID:16072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65385.exe
        5⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38261.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
        6⤵
        
        PID:15916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42897.exe
        5⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44249.exe
        5⤵
        
        PID:12528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
        5⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        6⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 488
        7⤵
        Program crash
        
        PID:8156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36673.exe
        6⤵
        
        PID:9040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
        6⤵
        
        PID:16024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47809.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35019.exe
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
        6⤵
        
        PID:15272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60078.exe
        5⤵
        
        PID:9816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2937.exe
        5⤵
        
        PID:14352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37514.exe
      4⤵
      PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45091.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59471.exe
        6⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54790.exe
        6⤵
        
        PID:12064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
        6⤵
        
        PID:16124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        5⤵
        
        PID:8992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        5⤵
        
        PID:13348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42549.exe
      4⤵
      PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33083.exe
        5⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57463.exe
        6⤵
        
        PID:13328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12797.exe
        5⤵
        
        PID:11452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52781.exe
        5⤵
        
        PID:15452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26654.exe
        5⤵
        
        PID:14620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1717.exe
      4⤵
      PID:8824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
      4⤵
      PID:11700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49504.exe
      4⤵
      PID:1612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57785.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63095.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13518.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
        6⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        8⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
        8⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16705.exe
        8⤵
        
        PID:16016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39361.exe
        7⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46481.exe
        7⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21053.exe
        6⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45927.exe
        7⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        7⤵
        
        PID:13592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38261.exe
        6⤵
        
        PID:9604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28024.exe
        6⤵
        
        PID:13644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        5⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12138.exe
        6⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35787.exe
        7⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14349.exe
        7⤵
        
        PID:15420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44649.exe
        6⤵
        
        PID:10072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36882.exe
        6⤵
        
        PID:14320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25224.exe
        5⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21069.exe
        6⤵
        
        PID:12356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9496.exe
        6⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe
        5⤵
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34308.exe
        5⤵
        
        PID:14260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10306.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9206.exe
        6⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24635.exe
        7⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exe
        7⤵
        
        PID:12756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59850.exe
        7⤵
        
        PID:15696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44649.exe
        6⤵
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exe
        6⤵
        
        PID:14376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57182.exe
        5⤵
        
        PID:7736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4562.exe
        6⤵
        
        PID:12752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
        5⤵
        
        PID:11884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        5⤵
        
        PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6480.exe
      4⤵
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51391.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        6⤵
        
        PID:13500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6217.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
        5⤵
        
        PID:14780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24842.exe
      4⤵
      PID:8088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
        5⤵
        
        PID:14212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43001.exe
      4⤵
      PID:10928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25469.exe
      4⤵
      PID:14412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18518.exe
      4⤵
      PID:15312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59019.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17515.exe
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7862.exe
        6⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16727.exe
        7⤵
        
        PID:14392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        6⤵
        
        PID:15136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59922.exe
        5⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53675.exe
        6⤵
        
        PID:15044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
        5⤵
        
        PID:11916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43157.exe
        5⤵
        
        PID:16064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21489.exe
        5⤵
        
        PID:14976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65490.exe
      4⤵
      PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26119.exe
        5⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18299.exe
        6⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        6⤵
        
        PID:14860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
        5⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
        5⤵
        
        PID:14656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26376.exe
      4⤵
      PID:7320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5973.exe
      4⤵
      PID:11000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe
      4⤵
      PID:14952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
      4⤵
      PID:15024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21692.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
      4⤵
      PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25159.exe
        5⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16519.exe
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40249.exe
        6⤵
        
        PID:16320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20249.exe
        5⤵
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11836.exe
        5⤵
        
        PID:14128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20425.exe
      4⤵
      PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
      4⤵
      PID:10684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49710.exe
      4⤵
      PID:14556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
    3⤵
    PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8386.exe
      4⤵
      PID:7828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe
      4⤵
      PID:10036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
      4⤵
      PID:14196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26654.exe
      4⤵
      PID:14408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18206.exe
    3⤵
    PID:8600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exe
    3⤵
    PID:10760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44169.exe
    3⤵
    PID:16356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10121.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10121.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16516.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55231.exe
        6⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48895.exe
        7⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        8⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28853.exe
        8⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20441.exe
        7⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39849.exe
        7⤵
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11489.exe
        6⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64877.exe
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        6⤵
        
        PID:14716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12345.exe
        5⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51391.exe
        6⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59051.exe
        7⤵
        
        PID:12368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6217.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
        6⤵
        
        PID:14572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16176.exe
        5⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26465.exe
        5⤵
        
        PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42535.exe
        5⤵
        
        PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59758.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62719.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
        6⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16223.exe
        7⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46399.exe
        8⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe
        8⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65521.exe
        8⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20633.exe
        7⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53061.exe
        7⤵
        
        PID:13804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10424.exe
        6⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
        6⤵
        
        PID:10852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13224.exe
        6⤵
        
        PID:14176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49730.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59943.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14790.exe
        7⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
        7⤵
        
        PID:14612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51142.exe
        6⤵
        
        PID:10312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
        6⤵
        
        PID:14528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60201.exe
        5⤵
        
        PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64302.exe
        5⤵
        
        PID:11184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44937.exe
        5⤵
        
        PID:15148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11472.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51339.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28667.exe
        6⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52647.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14681.exe
        7⤵
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22641.exe
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34804.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13120 -s 468
        7⤵
        Program crash
        
        PID:14324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8345.exe
        6⤵
        
        PID:16068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2745.exe
        5⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3218.exe
        6⤵
        
        PID:12696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
        5⤵
        
        PID:10732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33566.exe
        5⤵
        
        PID:14808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41126.exe
      4⤵
      PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        5⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58911.exe
        6⤵
        
        PID:15444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe
        5⤵
        
        PID:9404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2236.exe
        5⤵
        
        PID:14308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23576.exe
      4⤵
      PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56607.exe
        5⤵
        
        PID:11828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46309.exe
      4⤵
      PID:10948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16686.exe
      4⤵
      PID:14996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14470.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29279.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3680
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 724
        6⤵
        Program crash
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32329.exe
        5⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        6⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 460
        7⤵
        Program crash
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25573.exe
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
        6⤵
        
        PID:12488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26654.exe
        6⤵
        
        PID:15300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53674.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38423.exe
        6⤵
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45277.exe
        6⤵
        
        PID:14332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
        5⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1245.exe
        5⤵
        
        PID:14028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46362.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3570.exe
        5⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
        6⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5226.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
        7⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
        7⤵
        
        PID:15900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44842.exe
        6⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exe
        6⤵
        
        PID:12240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59598.exe
        6⤵
        
        PID:16176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe
        5⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        6⤵
        
        PID:13608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57373.exe
        5⤵
        
        PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        5⤵
        
        PID:12456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60237.exe
      4⤵
      PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46243.exe
        5⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51391.exe
        6⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23727.exe
        7⤵
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        7⤵
        
        PID:14036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6217.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
        6⤵
        
        PID:14600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        5⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62559.exe
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59570.exe
        6⤵
        
        PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45801.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54754.exe
        5⤵
        
        PID:14568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25329.exe
        5⤵
        
        PID:632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26902.exe
      4⤵
      PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
        5⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59798.exe
        5⤵
        
        PID:12392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9648.exe
      4⤵
      PID:8160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47091.exe
      4⤵
      PID:13064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20592.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3570.exe
        5⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-166.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50343.exe
        7⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13565.exe
        7⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
        7⤵
        
        PID:16132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52905.exe
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40670.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48142.exe
        5⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22383.exe
        6⤵
        
        PID:10276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        6⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8329.exe
        5⤵
        
        PID:10212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34308.exe
        5⤵
        
        PID:14292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
      4⤵
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-166.exe
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5802.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18381.exe
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7768.exe
        6⤵
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33426.exe
        6⤵
        
        PID:16352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44842.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28416.exe
        5⤵
        
        PID:12312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57793.exe
      4⤵
      PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe
        5⤵
        
        PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38261.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
        5⤵
        
        PID:15888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45174.exe
      4⤵
      PID:8624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33976.exe
      4⤵
      PID:12480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
      4⤵
      PID:14024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17913.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17913.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
      4⤵
      PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48895.exe
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40883.exe
        6⤵
        
        PID:9540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        6⤵
        
        PID:13516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24525.exe
        5⤵
        
        PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15344.exe
        5⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49273.exe
        5⤵
        
        PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10581.exe
      4⤵
      PID:8804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58289.exe
      4⤵
      PID:11848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
    3⤵
    PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38091.exe
      4⤵
      PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe
        5⤵
        
        PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        5⤵
        
        PID:13508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24281.exe
      4⤵
      PID:11164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
      4⤵
      PID:15128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
    3⤵
    PID:8572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29847.exe
    3⤵
    PID:10500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47733.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47733.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2654.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-477.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15438.exe
        5⤵
        Executes dropped EXE
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26015.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        7⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18381.exe
        7⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7768.exe
        7⤵
        
        PID:16368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
        7⤵
        
        PID:16312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24613.exe
        6⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40513.exe
        5⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43099.exe
        6⤵
        
        PID:11320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45697.exe
        5⤵
        
        PID:9424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3913.exe
        5⤵
        
        PID:12544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17476.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60083.exe
        5⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5433.exe
        6⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38017.exe
        6⤵
        
        PID:11152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
        6⤵
        
        PID:15120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        5⤵
        
        PID:7500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20528.exe
        5⤵
        
        PID:11008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24822.exe
        5⤵
        
        PID:14968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17988.exe
        5⤵
        
        PID:13964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4753.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
        5⤵
        
        PID:9200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61334.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19212.exe
      4⤵
      PID:8540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe
      4⤵
      PID:12348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47314.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
        5⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33135.exe
        6⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44649.exe
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36882.exe
        6⤵
        
        PID:12376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10581.exe
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60394.exe
        5⤵
        
        PID:13200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45646.exe
      4⤵
      PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        5⤵
        
        PID:8544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18381.exe
        5⤵
        
        PID:11056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7768.exe
        5⤵
        
        PID:14940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        5⤵
        
        PID:14608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37389.exe
      4⤵
      PID:8748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56503.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41077.exe
        5⤵
        
        PID:15952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1417.exe
      4⤵
      PID:11980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4968.exe
      4⤵
      PID:15268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
      4⤵
      PID:12860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32084.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6222.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42049.exe
        5⤵
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        6⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28853.exe
        6⤵
        
        PID:12980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
        5⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
        5⤵
        
        PID:13704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34457.exe
      4⤵
      PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36939.exe
        5⤵
        
        PID:11572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52258.exe
        5⤵
        
        PID:15532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42345.exe
      4⤵
      PID:9624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe
      4⤵
      PID:13672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8261.exe
    3⤵
    PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42455.exe
      4⤵
      PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35891.exe
        5⤵
        
        PID:12632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
      4⤵
      PID:9616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
      4⤵
      PID:14700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35828.exe
    3⤵
    PID:7496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1193.exe
    3⤵
    PID:11020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18072.exe
    3⤵
    PID:15868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
    3⤵
    PID:15732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6473.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6473.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1642.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42875.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        5⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21651.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61111.exe
        7⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32657.exe
        7⤵
        
        PID:13680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        6⤵
        
        PID:14732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4089.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51106.exe
        6⤵
        
        PID:15392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
        5⤵
        
        PID:11860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39073.exe
        5⤵
        
        PID:15932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
        5⤵
        
        PID:15756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53814.exe
      4⤵
      PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10270.exe
        5⤵
        
        PID:8644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18381.exe
        5⤵
        
        PID:10936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31696.exe
        5⤵
        
        PID:14816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42938.exe
        5⤵
        
        PID:15428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37389.exe
      4⤵
      PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3218.exe
        5⤵
        
        PID:12720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7053.exe
        5⤵
        
        PID:15116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11392.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47255.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe
        5⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
        6⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
        6⤵
        
        PID:13216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34893.exe
        5⤵
        
        PID:9244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35381.exe
        5⤵
        
        PID:12776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        5⤵
        
        PID:16052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64198.exe
      4⤵
      PID:7488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exe
        5⤵
        
        PID:10376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        5⤵
        
        PID:13432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
      4⤵
      PID:11876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39073.exe
      4⤵
      PID:15992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22641.exe
      4⤵
      PID:13924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31176.exe
    3⤵
    PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26119.exe
      4⤵
      PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        5⤵
        
        PID:13916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20788.exe
        5⤵
        
        PID:15616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
      4⤵
      PID:10080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
      4⤵
      PID:14692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32242.exe
    3⤵
    PID:7228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40935.exe
      4⤵
      PID:13036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61490.exe
      4⤵
      PID:16184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62845.exe
    3⤵
    PID:11060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65158.exe
    3⤵
    PID:14976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18518.exe
    3⤵
    PID:15780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26347.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26347.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe
      4⤵
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54411.exe
        5⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24339.exe
        6⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27405.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2620.exe
        6⤵
        
        PID:15064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51666.exe
        5⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61215.exe
        6⤵
        
        PID:16268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        6⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32116.exe
        5⤵
        
        PID:10572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47809.exe
      4⤵
      PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22155.exe
        5⤵
        
        PID:13436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60078.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17780.exe
      4⤵
      PID:14064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38489.exe
    3⤵
    PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe
      4⤵
      PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        5⤵
        
        PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        5⤵
        
        PID:13044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20441.exe
      4⤵
      PID:9556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39849.exe
      4⤵
      PID:13632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8120.exe
    3⤵
    PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61111.exe
      4⤵
      PID:9848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32657.exe
      4⤵
      PID:13700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
    3⤵
    PID:10452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28792.exe
    3⤵
    PID:14668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41337.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41337.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
    3⤵
    PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21651.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exe
        5⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        5⤵
        
        PID:15344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20057.exe
      4⤵
      PID:9796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11836.exe
      4⤵
      PID:14120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 244 -s 628
    3⤵
    - Program crash
    PID:8124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 244 -s 684
    3⤵
    - Program crash
    PID:8188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4210.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4210.exe
  2⤵
  PID:4120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
    3⤵
    PID:7884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7804.exe
    3⤵
    PID:12060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62213.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62213.exe
  2⤵
  PID:8592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
  2⤵
  PID:12284
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48369.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48369.exe
  2⤵
  PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3680 -ip 3680
1⤵
PID:964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5912 -ip 5912
1⤵
PID:5812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 244 -ip 244
1⤵
PID:7412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5908 -ip 5908
1⤵
PID:7676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2160 -ip 2160
1⤵
PID:8136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 244 -ip 244
1⤵
PID:9152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 13120 -ip 13120
1⤵
PID:13960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-10121.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10121.exe
Size 468KB
SHA256 f09802645b712f7d1dab7107af4106da30766138d0f05662d92f840c7eb9e5ea
MD5 8f90dc4c2d4c79773d3e079c0ffb3e40
SHA1 df25dbd63c24708ca8f900863bc0101a9bc81822
SHA512 2ef2fe36ed3d63b4f45763e826368f536815dbb2ec7acd1a359325718a0f96495a273db844f5710ae508d7293af239661c3f602206041df93a35be00d76ea578
SSDEEP 3072:dFmnog2/028U2bYoPzByqf8/0Dhj5IpUEpHGvozstkI+9krSWJl5:dFWo0XU2TPlyqfP0EztkvirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-11398.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11398.exe
Size 468KB
SHA256 a8c3cf9f7706ac7ce0806a868f0e117f4ecd706392e7305a8702e493fed6fe9a
MD5 eb0f87315a84298ecc8a615a7547aec1
SHA1 4035fa66251087cca7aabe7ca82a13b3f40edca8
SHA512 cab87b4361742242d5dadcae4dee03714f90c344406b8438f24b0b7fa949867ec15768a5766f64699a32ca4ad59b735deafa8e8501f870eca5d30e01648b0bac
SSDEEP 3072:dFmnog2/F28U2bYoPzByqf3/0Dhj5IpUEpHGvozsUkX+9kYSWJl5:dFWoFXU2TPlyqfe0EzUkOiYSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-13894.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13894.exe
Size 468KB
SHA256 47ec2b46fe3b765de04877ec2003ede1940edd59384c3bc0bb9b376c5b789011
MD5 4537ff916e326526145bbdf70e03d58f
SHA1 27a0fd0a6b609d9a30c47c404a11e1f5e21f746a
SHA512 dd578a779946d2a3433ef321728ca98b8bcc19512485a34c7c2c5af2d9b0c97449e5727e73e243f2696ddfffaf9b6a5cf947c00dc270b8f9ff679e6cfe32853e
SSDEEP 3072:dFmnog2/028U2bYZPzByqf3/0Dhj5IpUEpHGvoz8UkX+9krSWJl5:dFWo0XU2+Plyqfe0EjUkOirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-14470.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14470.exe
Size 468KB
SHA256 b389e80e33d56de3b146bccbc2b1249a84177d6ab0a7a76755ae45ac326687e7
MD5 d2e4e379efc6720e95247f2e52b12e19
SHA1 bce5ed54ff3e7a19c59132b0ca51ba48588b3ffe
SHA512 09ced312201b0d10cfeb2902b25ed12865cc26fc68f0f9e70b186c1675085f566745b6123598b48473eff0d2b0d3d75d3205b543f82402dcbf82555f8abfdf9e
SSDEEP 3072:dFmnog2/028U2bYmPzByqf8/0Dhj5IpUEpHGvozLtkI+9krSWJl5:dFWo0XU2xPlyqfP0EktkvirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-1642.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1642.exe
Size 468KB
SHA256 4191887c9e79b4228c3ad5da742333351c1ec69bae377ad96aff1b9fe8a1630e
MD5 c9116cb3f7a91645c05c7491aef0acc2
SHA1 a80fdf70f7cd87e010106f67fac96d234db2a3ad
SHA512 0dc1c0825270d116d7152ccbad9464ac3b9f162a64256f5968bca3b446eaff7a34729e31bfbb3ed9d88faf0c29f1d9b9fd667b433e99237486812d3cc9e4ed86
SSDEEP 3072:dFmnog2/028U2bYoPzByqf8/0Dhj5IpUEBHGvozstkX+9krSWJlH:dFWo0XU2TPlyqfP0MztkOirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-17735.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-17735.exe
Size 468KB
SHA256 9548056055335fcd2254db96c89b934c535125c26e55e707a3b7f51c6503f656
MD5 1ef63c6d46ae506538e5cc655e8361c6
SHA1 81c000287e4e70f221c927810b169d3cd1aead1a
SHA512 14ba0c7648f9f3952129c44baefa6197745603e27d5b8038c6f9f509fcce2366517b03d3edd01d5077a2d2f5e2f2152a64315b7baef6ca29ffcbebb1fd23668e
SSDEEP 3072:dFmnog2/028U2bYoPzByqf3/0Dhj5IpUEpHGvozsUkX+9krSWJl5:dFWo0XU2TPlyqfe0EzUkOirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-20592.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20592.exe
Size 468KB
SHA256 47280d7c74024d6b1c4dfded2c215b8158ccb1fa5f73a49dc2b9e690dc14d674
MD5 0aa37215e094c35afef323638c4a0148
SHA1 b9c8f0e19b33fa04b33a76fcdd316c079a4394c3
SHA512 2c9a33206d0efeaae10f143d9881af5e1d644fea2abb1242beb591ff68cd687022aa5fd487f29a80901d1bb607dac4ef8b42f804df0f3f964264624d5b4c646c
SSDEEP 3072:dFmnog2/028U2bYRPzByqf8/0Dhj5IpUEpHGvozstkI+9krSWJl5:dFWo0XU2GPlyqfP0EztkvirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-21473.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21473.exe
Size 468KB
SHA256 f856dfcd804185e0d42fc6ce942ad33b137ce251e81ba8e697a1d6bda813d725
MD5 01781f9a606d91044444c8949d3b2a30
SHA1 dcefeb3dfb49ac64154724128512d6b47ae967e4
SHA512 67410325e0c259a9079a08976e17411963ef029ab839c76b008400b075da1a2c6742f022ce480db43c67c570d67fc2247c9063b71b5a9a51d9de52bbfdcef127
SSDEEP 3072:dFmnog2/F28U2bYoPzByqf3/0Dhj5IpUEpHGvozsUkX+9kuSWJl5:dFWoFXU2TPlyqfe0EzUkOiuSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-26531.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-26531.exe
Size 468KB
SHA256 daa12b32f97bb9b75a8f23a8f2e30586a0e1146de467f4abccdc2f572b1b99d7
MD5 609a551f84c1ad7790a7791502e17597
SHA1 a587b92d9f99221e0a5254bfd0afd86d7fc7c7a1
SHA512 bfd2c71d0d495a9308cc7d3abd63439168aa7421a2891afbb443b6fc619181b5740accf2b05e26ec6c4bfd6fe45331c08cb388f840da9de81f93dbe764377bed
SSDEEP 3072:dFmnog2/F28U2bYoPzByqf3/0Dhj5IpUEpHGvSzsUkX+9kYSWJl5:dFWoFXU2TPlyqfe0EdUkOiYSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-2654.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2654.exe
Size 468KB
SHA256 661029b404c8151421b0fa9e13836f151fe5f427d42ec5bcaa45d8f0917d2d06
MD5 343228ae1f6afb38cfde3a67ec30a1ba
SHA1 62fbe6b1815ddc97d57f393f6ec44eed725a5879
SHA512 aeff5e820205bebb000ecb0e16c2c0b07616a7fab0818ad56a97352ee1f19283c5f3c449a688d8ede00d77aa98b734207a2fe84b134e98b03664da315fde60b3
SSDEEP 3072:dFmnog2/028U2bYoPzByqf8/0Dhj5IpUEpHGvozstkE+9krSWJl1:dFWo0XU2TPlyqfP0EztkzirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-27277.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27277.exe
Size 468KB
SHA256 940d231a0ca101ca9b146bc4cf67cc1cdbfbc133a5f817a718694d5ba6422b09
MD5 7b19e54ea6e85cd351b5e45bb3339aeb
SHA1 9c4e0f1767b6774d1008731a0003bd861d21f29b
SHA512 1a07c454b26c27ea6f2857e5c389e5919c9a21e9c253ff4fe3a0064bff8eb7eb958da056c7988235c58c9ccfb7790c5330e9b57c6b46d76d453b6ecf0f5fdee1
SSDEEP 3072:dFmnog2/028U2bYoPzByqf3/0Dhj5IpUEpHGvozsUkX+9kYSHJl5:dFWo0XU2TPlyqfe0EzUkOiYSH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-33171.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33171.exe
Size 468KB
SHA256 53215dd4aef244b92bcfff1faafae0950e45e942c75e90f354b280a4362a791f
MD5 dffcb5f053b41663648e6121c3a8b185
SHA1 45ba1f8d52c732c9ece6f6d17ddc5f1beeb60a14
SHA512 839114013a14962d5cbb5bdb0e9efbbbf028aee5264f602109c7363c7674b196c662729150bda0afc26ed2ccc0fc9f87936204d736e8eeaccdc64d42a546cf0e
SSDEEP 3072:dFmnog2/F28U2bYoPzByqf3/0Dhj5IpUEpHGvSzLUkX+9kYSWJl5:dFWoFXU2TPlyqfe0EOUkOiYSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-36427.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-36427.exe
Size 468KB
SHA256 9c28ee457a89e8b7cbde1d2a3480598263fc43274dc8efc26d8774a616d88014
MD5 8e44bb976f3b3a7d8174b18253e0966b
SHA1 7d80c1f4738fab25b5582260f4100522e5a2fa09
SHA512 a79c68ceedea20d6ca0f3189de9d8843e9a46fe9bad0359e72bfdef01726ff3e84c2bdb07873409a9d79180171afec737b528a71bef4b39e5ac49e69141f7fa4
SSDEEP 3072:dFmnog2/028U2bYoPzByqf8/0Dhj5IpUEpHGvozsUkX+9krSWJl5:dFWo0XU2TPlyqfP0EzUkOirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-38081.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38081.exe
Size 468KB
SHA256 edd7668d6b64cdba97d5e6925d0fc0fdb4eff6aa6322f6c1ce584b53e1834f6e
MD5 103b6b5e0f8ea6151ec2aadfacde539d
SHA1 d827608fb2e97fc4a8a834a401c319ac857d7eaa
SHA512 321ae326b60fcd838635b51e319be012e39d21583b1c8163a756041029fde5c60f87f521f8b4294a79173b99059bb8f04cdd59495ab4f57046b007810db9e012
SSDEEP 3072:dFmnog2/028U2bYoPzByqf8/0Dhj5IpUEpHGvozsUkX+9krSWJlT:dFWo0XU2TPlyqfP0EzUkOirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-40651.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
Size 468KB
SHA256 890e0de618f045378a3c4c7dc1d112d7d8edf315d462ff3ad50426172ff6088e
MD5 7037293c3c39f070c846cc67e6e0aa01
SHA1 fb9b32c27b70cb23576e1508c2e763d1c6db4f36
SHA512 53635476bec226494bb6a75a825d43c6825c3cb0149b38f48e7e7e476b84227736c5a027e147611b0207b97d668a5cbcda7fff194ae8ffb014e462c39657c039
SSDEEP 3072:dFmnog2/028U2bYoPzByqf8/0Dhj5IpUEpHGvozstka+9krSWJl5:dFWo0XU2TPlyqfP0EztktirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-43495.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43495.exe
Size 468KB
SHA256 898f28bb3acaad2a2331b1814ebb38d612d2aa0f43ff658d3ad4cceed7f1ab14
MD5 6f6c44cd27f8fe1fdccb850e94260f27
SHA1 927cdb58560ca6b021738d864872adccdf91eabf
SHA512 b16f5d57e2919e69951e89b55070ef9ac2347876357b15280828f53bc7cc708451a47a928b58f374592bf194fc65409c533d67bbd95d8d96903417f2ee114e0e
SSDEEP 3072:dFmnog2/028U2bYoPzByqf8/0Dhj5IpUEpHGvozsUkX19krSWJlT:dFWo0XU2TPlyqfP0EzUkFirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-47314.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47314.exe
Size 468KB
SHA256 1700b5a4208b1beca64d2ca0f2f4f11d3e5d06373ef66ed3fbc226f96fe24a64
MD5 4d77774604aa7eaed829dae79a71928d
SHA1 f9076958429801685c6286e25b6ffe398b62815e
SHA512 de17d44245e401ff3c253994d032df42d18fb4b9ea6a4df2b5554755dda6ec5b4e21819e02af84801de9ad34d7d61408c9c0ff6cf5452ca04e94691133330bef
SSDEEP 3072:dFmnog2/028UpbYoPzByqf8/0Dhj5IpUEpHGvozstkE+9krSWJl5:dFWo0XUpTPlyqfP0EztkzirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-47733.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47733.exe
Size 468KB
SHA256 1cef070191a286388f4a8908e438a1848897f7cfd6e3fea84e72ee9d65cd5cb5
MD5 d17fb8db5e0f74272e72724563939e96
SHA1 82882ea90fcf02ef773f3e02faee55101f7c9449
SHA512 0db6d49ddcb0fa01b13d1f836a0ac1909dee6284328c9045d753fcbc2f5f05e2702135505687e9587c789f666a4f784385705897d6e655ac8ede8268fcb4921c
SSDEEP 3072:dFmnog2/028U2bYoPzByqf8/0Dhj5IpUEpHGvozstkE+9krSWJl5:dFWo0XU2TPlyqfP0EztkzirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-48931.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-48931.exe
Size 468KB
SHA256 12026ef5ba29dce01e32bde81cd89a7537844959923ed31e1b4de36000e8e763
MD5 b4cc00556627f31d072d0a1acf1798c1
SHA1 7ffbf5d5e68e8caf2601cc3f0b29ee1f33ebfd0d
SHA512 9690628d7e0488497dc1c038e7c48b7edb8651536aebdfb2c8739967a2f1f4297ee82ad8fe1c04fa2bbc34e8f206dc5ea477ef0003648895df87037d83bac480
SSDEEP 3072:dFmnog2/028U2bYoPzByqf3/0Dhj5IpUEpHGvozsUkX+9SYSHJl5:dFWo0XU2TPlyqfe0EzUkOUYSH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-50651.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50651.exe
Size 468KB
SHA256 7f33af32cc628b57144c8f9a4c13cc2443b9f6bba420e7e39ee3b0175b00e01c
MD5 f2b1e8c3c89a60c2a27a25d98af3474e
SHA1 028379edec96f52ebe314e921bf9cbacffea5bf0
SHA512 9f1489414adcd7bbf82220344cdf8372ab6e36b4001714be7d7155fa7a95e06caece98954bb1bfe6f369f19ebe4898505b6dc5cb2b41aee5b3ad0fde9a11a263
SSDEEP 3072:dFmnog2/028U2bYoPzByqf8/0Dhj5IpUEpHGvozsUkX19kHSWJlT:dFWo0XU2TPlyqfP0EzUkFiHSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-5156.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
Size 468KB
SHA256 6438d666e2d817dd3d4d156151be679167e00b2a5dba4812c07d3fccb89e7b79
MD5 30fb2ba3dbabd7e8641ff6238a656fc0
SHA1 d5b6bc01fd60507cc08fdc2d76813495e689baa9
SHA512 4435e0d8bf2514ace2ec63889768a24d3ff533f65676e72c5d8b25bd1731d5da2f4137665089c1ff27a63f03878010825260273e750aaeb7c4b381ba2f41b105
SSDEEP 3072:dFmnogg/028U2bYoPzByqf8/0Dhj5IpUEpHGvozstkX+9krSWJl5:dFWomXU2TPlyqfP0EztkOirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-53863.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53863.exe
Size 468KB
SHA256 be0742703080a1de810c95b2f858864d3dd4905ed6b3cf5029f50d47f7dbff89
MD5 08f4b8d5d09493c25d898f8915ba318c
SHA1 89f911daad209c532d8c488990822f40c66967b8
SHA512 2196807f3631f37150a7bff4a01aa24879be408f96776383a6efaa3b1bd42621d66e09a6c8e98496458c6ffab255931c796923cead88d0fcd553cbac98f818a2
SSDEEP 3072:dFmnog2/028U2bYoPzByqf3/0Dhj5IpUEpHGvozsUkX+9kYSWJl5:dFWo0XU2TPlyqfe0EzUkOiYSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-5653.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
Size 468KB
SHA256 561803fda27b57e7ac71132e357b4ceee7516b8244bf976d8642dce49ca80c21
MD5 99147c8fd59efd2f11cfb4579509fb84
SHA1 e4500dfe62f2563bb8c45355b7c22044396c6e60
SHA512 39b95b4c9eb62122729ff6d8cedd3fb523b91adab3a53dbfec278f4faaa31ecc097ad744f515e0c03e5e7aa885fa513141606cb8a196a4c79ab408882d9faf02
SSDEEP 3072:dFmnog2/028U2bYoPzByqf8/0Dhj5IpEEpHGvozsUkX+9krSWJl5:dFWo0XU2TPlyqfP00zUkOirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-56965.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
Size 468KB
SHA256 4f992e1a1753b825c40191b70fd55d263e77229d5efebaf580f237910dbd3a41
MD5 ccd0597119ad8c132dcfa804f35be17e
SHA1 6de80f31f437be2568757bae8ca20a58f71d3cde
SHA512 67eb15ab52d1e30c4d83b1ac979170578a89941ddb6273bc8f37f4d99a6255d026bec1d1724b0227185c3e8c41daabc44e8caa37bf4ef53d3ec911c2db87e320
SSDEEP 3072:dFmnog2/028U2bYoPzByqf3/0Dhj5IpUEpHGvozsUkX+9wrSWJl5:dFWo0XU2TPlyqfe0EzUkOWrSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-57785.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57785.exe
Size 468KB
SHA256 9d5845632175d82e09503edbe8b52cfc3d2fa329ea89afba0294b9e49b2db8ed
MD5 274b6debc9140d49a7847da9d718d2f5
SHA1 8014acf86209ec1f3b4c53c3d831378b05fc0986
SHA512 39dfef1d13202ca7700324bf46ad25a968ef2871e258b2e9ae9fd1cad7ec27d862ada9d02cb8433f761dbb44fea1ce3d411cd3ea92172306e2fc65c9ac16a46c
SSDEEP 3072:dFmnog2/028U2bYoPzByqf8/0Dhj5IpUEpHGvozsUkX+9kUSWJl5:dFWo0XU2TPlyqfP0EzUkOiUSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-59566.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59566.exe
Size 468KB
SHA256 ada3ae11ad2160f64c01a4017010c0e1e4a975a2702c9246b47e2aa34998acd7
MD5 9ddeb4e93adc000720cf1563b2e11317
SHA1 f93b70095c9f3e128a624ac64bc223b4407232f5
SHA512 57068c30a0481d59235158c42e7dfb239cb921e6a1e7a180e70aef32a1bac598205ba29e7cd49d2409c9eeaa1eed49be79eb399140a57c56d8bab01070ebc01e
SSDEEP 3072:dFmnog2/028U2bYoPzByqf8/0Dhj5IpUEpHVvozsUkX+9krSWJlT:dFWo0XU2TPlyqfP0jzUkOirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-59758.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59758.exe
Size 468KB
SHA256 3bc970231b9d0cfd6c1660a93687ab8f9bb52b7e84f6015da4169d5793a0eee0
MD5 cba24150da50dac66e87909914640da0
SHA1 239a89f6bae6bb5f661748fae3ba4c854535916b
SHA512 07ed0fd34a2d802985551017fb2b5e7284b141f8f067cde0f1a917bdbc9824c8564a03fc7e3e0a26c9a48a95802dbe2a81383c577c50f8307c892f7893a2ce62
SSDEEP 3072:dFmnog2/028U2bYoPzByqf8/0Dhj5IpUEpHGhozstka+9krSWJl5:dFWo0XU2TPlyqfP0EVtktirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-63095.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63095.exe
Size 468KB
SHA256 0f867e6dfb25155d74e89bd9309628ded62f0f8b495255ad22581af58e1d8a09
MD5 14fdaec8c560500bf6ddd501e76b6bc4
SHA1 b103dc831f2746ce284a8ff59512b4df1bca6699
SHA512 c405fe40f568c5e9f54f13bfcbca3d5ba2bfab9097e062ae7b0dde58c2d2822641ba6a33d3be30fc1087403bfb96d2753a9bda42a3c8f1c3965fdebf3b5912a1
SSDEEP 3072:dFmnog2/028U2bYoPzByqf8/0Dhj5IpUEpHGvozsUkX+9kUSWJlb:dFWo0XU2TPlyqfP0EzUkOiUSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-64662.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
Size 468KB
SHA256 a9047189f586467c72f85b66948a0d99fb7209828f84472c45e1244fab68d2a1
MD5 c41861be229c5d938764886930123cd6
SHA1 11d0f8c4913f3a4fb4d12605a18c199e5a8444e0
SHA512 7fc03c125e0ea3afbd651b378a6e8eb579230e55e23896c8d5fa6e3105a16b0a6a6a4a69cd9c1be1cc5769272a701ee34c09aa6c79cf9a619884971bce05e230
SSDEEP 3072:dFmnog2/028U2bYoPzByqf8/0Dhj5IpUEpHGvozLtkI+9krSWJl5:dFWo0XU2TPlyqfP0EktkvirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-6473.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6473.exe
Size 468KB
SHA256 e1349e45ade7a11fe4ed6f70043b6d4a8698d3e8d51148e17d10b2c2156af6c4
MD5 71cd56bfa019d72dcecad1d20efba658
SHA1 b2cf9f775cf7f074adc3b15fed50e2b1c71a690c
SHA512 d7ebd14d62e86a6f3819983dad56cf851b54056a97507aab10f0e290e414d7889eb3e7e2cc7800f8a9805321f9b6e7caac5b409dea00bb5133d2f9bf19f3d130
SSDEEP 3072:dFmnog2/028U2bYoPzByqf8/0Dhj5IpUEBHGvozstkX+9krSWJl5:dFWo0XU2TPlyqfP0MztkOirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-65238.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-65238.exe
Size 468KB
SHA256 2942cdf5cb3bae0fea667f95252333c4910c2ee0ad74c561433d6ef53ed038ef
MD5 e0b2a75151adf3465d87375c5a53338d
SHA1 be8104bce6b391d6e023688a263f795a4ec864fe
SHA512 c23642da28807cc09feaa9fad4be872cc103bb4b09a71952aece539b4971ef768c974b0e5203c8cddfe19fab778ef922d667b066177445c829b336511807d62c
SSDEEP 3072:dFmnog2/028U2bYoPzByqf3/0Dhj5IpUEpHGvoz8UkX+9krSWJl5:dFWo0XU2TPlyqfe0EjUkOirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-6738.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
Size 468KB
SHA256 462aa69613eafc1ca4254b7c2b6e8e013577420ab7241e643cb9e863eccf317a
MD5 59452ba30a3f923a80366ee1034b9e7c
SHA1 3432efd08aa78be06fcdf944cbe52d97551d682d
SHA512 2ce1b35300601f242ea8fac49d749344d53e74e5e0ac8241b7072c2b74178e159949bf47d12c034173b8648a0659d61ac8bcb579be0ad1ad8cd09638aafe689d
SSDEEP 3072:dpmnog2/028U2bYoPzByqf8/0Dhj5IpUEpHGvozstka+9krSWJl5:dpWo0XU2TPlyqfP0EztktirSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/64-382-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/244-326-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/464-185-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/684-456-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1108-351-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1136-380-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1204-211-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1244-27-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1316-388-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1384-55-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1404-449-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1572-68-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1588-186-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1684-286-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1692-389-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1712-339-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1772-150-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1780-253-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1848-383-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1880-19-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1904-315-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1916-241-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1920-473-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1952-236-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1960-127-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1964-266-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2000-13-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2040-461-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2148-318-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2196-95-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2288-7-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2296-93-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2588-317-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2592-283-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2604-100-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2704-469-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2924-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3096-387-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3100-348-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3176-470-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3276-344-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3280-44-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3312-118-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3316-225-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3340-231-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3384-192-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3420-130-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3456-254-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3592-151-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3604-451-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3680-246-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3680-644-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3732-462-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3744-187-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3760-381-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3764-450-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3940-190-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3972-446-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4004-87-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4028-259-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4032-322-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4076-217-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4088-198-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4220-438-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4228-139-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4232-463-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4240-423-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4260-385-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4388-191-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4444-340-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4480-435-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4484-110-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4648-341-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4704-42-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4708-272-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4724-37-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4760-464-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4784-384-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4792-352-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4920-316-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4924-386-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5020-350-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5056-430-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5080-65-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5152-474-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5248-708-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5340-709-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5352-714-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5372-734-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5388-748-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5396-744-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5412-749-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5424-750-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5436-751-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5444-760-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5728-704-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/13432-2510-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/15436-2795-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/16016-2701-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/16092-2680-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads