fca0e6bee12137e2b46231908b46e7a8a324d3cb05ca529b901d26f6b15c2645

Analysis

max time kernel
149s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 04:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fca0e6bee12137e2b46231908b46e7a8a324d3cb05ca529b901d26f6b15c2645.exe
Size

468KB
MD5

a2ee91452f290b3fca22788002a7a06f
SHA1

8b95e129722ee5d14573f546ada2f0693ea8ecc5
SHA256

fca0e6bee12137e2b46231908b46e7a8a324d3cb05ca529b901d26f6b15c2645
SHA512

d8d165fc8224f5918124a735cc5ece88eee1193695a109f8b94a4cb5f3d9ebc6d6c596833a72dfb2c75efdf2f357f6753ce24536b6d1c47d2e612aa3cba4a459
SSDEEP

3072:t+7Oog5dWJ8U1bYTPzijfx8/9Chj9WpOsdHeeVpb6fqWnlVNa7l8:t+Co/aU1APejfxT2m06fhlVNa

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
884	Unicorn-54526.exe
5108	Unicorn-37417.exe
496	Unicorn-51293.exe
3684	Unicorn-21857.exe
2788	Unicorn-2571.exe
3316	Unicorn-54373.exe
3456	Unicorn-6599.exe
4972	Unicorn-41670.exe
208	Unicorn-37839.exe
3868	Unicorn-1213.exe
4492	Unicorn-57513.exe
3192	Unicorn-25453.exe
2172	Unicorn-19587.exe
4316	Unicorn-20897.exe
1996	Unicorn-56676.exe
5000	Unicorn-45510.exe
1952	Unicorn-62614.exe
5008	Unicorn-9884.exe
1796	Unicorn-48124.exe
4236	Unicorn-51177.exe
3036	Unicorn-10144.exe
648	Unicorn-24020.exe
1488	Unicorn-55816.exe
1300	Unicorn-50720.exe
3244	Unicorn-2091.exe
4696	Unicorn-43886.exe
2380	Unicorn-50985.exe
4904	Unicorn-47342.exe
3736	Unicorn-18239.exe
368	Unicorn-54441.exe
4560	Unicorn-54176.exe
1040	Unicorn-55593.exe
5080	Unicorn-56169.exe
4064	Unicorn-56169.exe
3220	Unicorn-55017.exe
2316	Unicorn-19692.exe
940	Unicorn-41980.exe
1628	Unicorn-38608.exe
384	Unicorn-55209.exe
1240	Unicorn-35343.exe
3828	Unicorn-39972.exe
3772	Unicorn-13237.exe
1052	Unicorn-58717.exe
3276	Unicorn-37550.exe
1472	Unicorn-45417.exe
5076	Unicorn-4384.exe
1392	Unicorn-28889.exe
4032	Unicorn-49864.exe
3812	Unicorn-44263.exe
1564	Unicorn-63599.exe
2864	Unicorn-60799.exe
1064	Unicorn-9900.exe
5012	Unicorn-9900.exe
560	Unicorn-30726.exe
468	Unicorn-38894.exe
4976	Unicorn-29657.exe
4692	Unicorn-26127.exe
492	Unicorn-45993.exe
3588	Unicorn-61567.exe
2176	Unicorn-64367.exe
1544	Unicorn-10668.exe
4408	Unicorn-33030.exe
1528	Unicorn-12972.exe
3836	Unicorn-31001.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
5348	5916	WerFault.exe	208
8756	6996	WerFault.exe	300
8692	7204	WerFault.exe	315
10212	7240	WerFault.exe	318
8196	6968	WerFault.exe	302
13804	15228	WerFault.exe	738
10476	1140	WerFault.exe	743

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62793.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20897.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	13992	dwm.exe
Token: SeChangeNotifyPrivilege	13992	dwm.exe
Token: 33	13992	dwm.exe
Token: SeIncBasePriorityPrivilege	13992	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1576	fca0e6bee12137e2b46231908b46e7a8a324d3cb05ca529b901d26f6b15c2645.exe
884	Unicorn-54526.exe
5108	Unicorn-37417.exe
496	Unicorn-51293.exe
3684	Unicorn-21857.exe
2788	Unicorn-2571.exe
3316	Unicorn-54373.exe
3456	Unicorn-6599.exe
4972	Unicorn-41670.exe
208	Unicorn-37839.exe
4492	Unicorn-57513.exe
3868	Unicorn-1213.exe
3192	Unicorn-25453.exe
2172	Unicorn-19587.exe
4316	Unicorn-20897.exe
1996	Unicorn-56676.exe
5000	Unicorn-45510.exe
1952	Unicorn-62614.exe
1796	Unicorn-48124.exe
5008	Unicorn-9884.exe
4236	Unicorn-51177.exe
3036	Unicorn-10144.exe
2380	Unicorn-50985.exe
1488	Unicorn-55816.exe
1300	Unicorn-50720.exe
4696	Unicorn-43886.exe
648	Unicorn-24020.exe
3244	Unicorn-2091.exe
4904	Unicorn-47342.exe
368	Unicorn-54441.exe
3736	Unicorn-18239.exe
4560	Unicorn-54176.exe
1040	Unicorn-55593.exe
5080	Unicorn-56169.exe
4064	Unicorn-56169.exe
3220	Unicorn-55017.exe
2316	Unicorn-19692.exe
384	Unicorn-55209.exe
940	Unicorn-41980.exe
1628	Unicorn-38608.exe
1240	Unicorn-35343.exe
3828	Unicorn-39972.exe
3772	Unicorn-13237.exe
1052	Unicorn-58717.exe
1472	Unicorn-45417.exe
3276	Unicorn-37550.exe
3812	Unicorn-44263.exe
2864	Unicorn-60799.exe
4032	Unicorn-49864.exe
1064	Unicorn-9900.exe
5012	Unicorn-9900.exe
1392	Unicorn-28889.exe
5076	Unicorn-4384.exe
1564	Unicorn-63599.exe
468	Unicorn-38894.exe
560	Unicorn-30726.exe
4692	Unicorn-26127.exe
492	Unicorn-45993.exe
1544	Unicorn-10668.exe
2176	Unicorn-64367.exe
3588	Unicorn-61567.exe
4408	Unicorn-33030.exe
1528	Unicorn-12972.exe
1480	Unicorn-56574.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 884	1576	fca0e6bee12137e2b46231908b46e7a8a324d3cb05ca529b901d26f6b15c2645.exe	86
PID 1576 wrote to memory of 884	1576	fca0e6bee12137e2b46231908b46e7a8a324d3cb05ca529b901d26f6b15c2645.exe	86
PID 1576 wrote to memory of 884	1576	fca0e6bee12137e2b46231908b46e7a8a324d3cb05ca529b901d26f6b15c2645.exe	86
PID 884 wrote to memory of 5108	884	Unicorn-54526.exe	87
PID 884 wrote to memory of 5108	884	Unicorn-54526.exe	87
PID 884 wrote to memory of 5108	884	Unicorn-54526.exe	87
PID 1576 wrote to memory of 496	1576	fca0e6bee12137e2b46231908b46e7a8a324d3cb05ca529b901d26f6b15c2645.exe	88
PID 1576 wrote to memory of 496	1576	fca0e6bee12137e2b46231908b46e7a8a324d3cb05ca529b901d26f6b15c2645.exe	88
PID 1576 wrote to memory of 496	1576	fca0e6bee12137e2b46231908b46e7a8a324d3cb05ca529b901d26f6b15c2645.exe	88
PID 5108 wrote to memory of 3684	5108	Unicorn-37417.exe	89
PID 5108 wrote to memory of 3684	5108	Unicorn-37417.exe	89
PID 5108 wrote to memory of 3684	5108	Unicorn-37417.exe	89
PID 1576 wrote to memory of 2788	1576	fca0e6bee12137e2b46231908b46e7a8a324d3cb05ca529b901d26f6b15c2645.exe	91
PID 1576 wrote to memory of 2788	1576	fca0e6bee12137e2b46231908b46e7a8a324d3cb05ca529b901d26f6b15c2645.exe	91
PID 1576 wrote to memory of 2788	1576	fca0e6bee12137e2b46231908b46e7a8a324d3cb05ca529b901d26f6b15c2645.exe	91
PID 884 wrote to memory of 3316	884	Unicorn-54526.exe	90
PID 884 wrote to memory of 3316	884	Unicorn-54526.exe	90
PID 884 wrote to memory of 3316	884	Unicorn-54526.exe	90
PID 496 wrote to memory of 3456	496	Unicorn-51293.exe	92
PID 496 wrote to memory of 3456	496	Unicorn-51293.exe	92
PID 496 wrote to memory of 3456	496	Unicorn-51293.exe	92
PID 3684 wrote to memory of 4972	3684	Unicorn-21857.exe	93
PID 3684 wrote to memory of 4972	3684	Unicorn-21857.exe	93
PID 3684 wrote to memory of 4972	3684	Unicorn-21857.exe	93
PID 5108 wrote to memory of 208	5108	Unicorn-37417.exe	94
PID 5108 wrote to memory of 208	5108	Unicorn-37417.exe	94
PID 5108 wrote to memory of 208	5108	Unicorn-37417.exe	94
PID 2788 wrote to memory of 3868	2788	Unicorn-2571.exe	95
PID 2788 wrote to memory of 3868	2788	Unicorn-2571.exe	95
PID 2788 wrote to memory of 3868	2788	Unicorn-2571.exe	95
PID 3316 wrote to memory of 4492	3316	Unicorn-54373.exe	96
PID 3316 wrote to memory of 4492	3316	Unicorn-54373.exe	96
PID 3316 wrote to memory of 4492	3316	Unicorn-54373.exe	96
PID 1576 wrote to memory of 3192	1576	fca0e6bee12137e2b46231908b46e7a8a324d3cb05ca529b901d26f6b15c2645.exe	97
PID 1576 wrote to memory of 3192	1576	fca0e6bee12137e2b46231908b46e7a8a324d3cb05ca529b901d26f6b15c2645.exe	97
PID 1576 wrote to memory of 3192	1576	fca0e6bee12137e2b46231908b46e7a8a324d3cb05ca529b901d26f6b15c2645.exe	97
PID 884 wrote to memory of 2172	884	Unicorn-54526.exe	98
PID 884 wrote to memory of 2172	884	Unicorn-54526.exe	98
PID 884 wrote to memory of 2172	884	Unicorn-54526.exe	98
PID 3456 wrote to memory of 4316	3456	Unicorn-6599.exe	99
PID 3456 wrote to memory of 4316	3456	Unicorn-6599.exe	99
PID 3456 wrote to memory of 4316	3456	Unicorn-6599.exe	99
PID 496 wrote to memory of 1996	496	Unicorn-51293.exe	100
PID 496 wrote to memory of 1996	496	Unicorn-51293.exe	100
PID 496 wrote to memory of 1996	496	Unicorn-51293.exe	100
PID 4972 wrote to memory of 5000	4972	Unicorn-41670.exe	101
PID 4972 wrote to memory of 5000	4972	Unicorn-41670.exe	101
PID 4972 wrote to memory of 5000	4972	Unicorn-41670.exe	101
PID 208 wrote to memory of 1952	208	Unicorn-37839.exe	102
PID 208 wrote to memory of 1952	208	Unicorn-37839.exe	102
PID 208 wrote to memory of 1952	208	Unicorn-37839.exe	102
PID 3684 wrote to memory of 5008	3684	Unicorn-21857.exe	103
PID 3684 wrote to memory of 5008	3684	Unicorn-21857.exe	103
PID 3684 wrote to memory of 5008	3684	Unicorn-21857.exe	103
PID 5108 wrote to memory of 1796	5108	Unicorn-37417.exe	104
PID 5108 wrote to memory of 1796	5108	Unicorn-37417.exe	104
PID 5108 wrote to memory of 1796	5108	Unicorn-37417.exe	104
PID 4492 wrote to memory of 4236	4492	Unicorn-57513.exe	105
PID 4492 wrote to memory of 4236	4492	Unicorn-57513.exe	105
PID 4492 wrote to memory of 4236	4492	Unicorn-57513.exe	105
PID 3868 wrote to memory of 3036	3868	Unicorn-1213.exe	106
PID 3868 wrote to memory of 3036	3868	Unicorn-1213.exe	106
PID 3868 wrote to memory of 3036	3868	Unicorn-1213.exe	106
PID 2788 wrote to memory of 648	2788	Unicorn-2571.exe	108

C:\Users\Admin\AppData\Local\Temp\fca0e6bee12137e2b46231908b46e7a8a324d3cb05ca529b901d26f6b15c2645.exe
"C:\Users\Admin\AppData\Local\Temp\fca0e6bee12137e2b46231908b46e7a8a324d3cb05ca529b901d26f6b15c2645.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54526.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54526.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37417.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21857.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55593.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33030.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-77.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-77.exe
        9⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13253.exe
        10⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25836.exe
        11⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3978.exe
        11⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
        11⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23370.exe
        10⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37608.exe
        10⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27343.exe
        10⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60565.exe
        9⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe
        9⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25039.exe
        9⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe
        8⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27561.exe
        9⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        10⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2613.exe
        10⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
        10⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22197.exe
        9⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe
        9⤵
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48967.exe
        9⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65063.exe
        8⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7211.exe
        9⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        9⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19701.exe
        8⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19629.exe
        8⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12972.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-928.exe
        8⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13144.exe
        9⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
        10⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58777.exe
        10⤵
        
        PID:16568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        9⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27527.exe
        9⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60373.exe
        8⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
        9⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30518.exe
        9⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5668.exe
        8⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27329.exe
        8⤵
        
        PID:15584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35117.exe
        8⤵
        
        PID:17980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe
        7⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37020.exe
        8⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe
        9⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28571.exe
        8⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17807.exe
        8⤵
        
        PID:16168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe
        7⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3178.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17479.exe
        7⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19692.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe
        7⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24665.exe
        8⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        9⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe
        9⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5602.exe
        9⤵
        
        PID:13704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27605.exe
        9⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
        8⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1622.exe
        9⤵
        
        PID:12868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56737.exe
        9⤵
        
        PID:15796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31285.exe
        9⤵
        
        PID:18428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe
        8⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9078.exe
        8⤵
        
        PID:17404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19899.exe
        7⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64566.exe
        8⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
        9⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        9⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
        8⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2453.exe
        8⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49304.exe
        7⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59381.exe
        7⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        7⤵
        
        PID:8656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34299.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30062.exe
        8⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        9⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        10⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56353.exe
        10⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
        10⤵
        
        PID:17968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9909.exe
        9⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28677.exe
        9⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38154.exe
        8⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26929.exe
        8⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        8⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42204.exe
        7⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        8⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64668.exe
        9⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        9⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23940.exe
        8⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57135.exe
        8⤵
        
        PID:16424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2772.exe
        7⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
        7⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
        6⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
        7⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7240 -s 464
        8⤵
        Program crash
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23946.exe
        7⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65103.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5579.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60038.exe
        6⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28136.exe
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9884.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56169.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56574.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24390.exe
        8⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28905.exe
        9⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 488
        10⤵
        Program crash
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        9⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29439.exe
        9⤵
        
        PID:15596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53549.exe
        8⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40091.exe
        8⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
        8⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19899.exe
        7⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
        8⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6142.exe
        9⤵
        
        PID:14572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
        9⤵
        
        PID:16560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57574.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26565.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15954.exe
        7⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21441.exe
        7⤵
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
        7⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        6⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1805.exe
        7⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exe
        8⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        9⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
        9⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14373.exe
        9⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42285.exe
        8⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11863.exe
        8⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14436.exe
        7⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62181.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41951.exe
        7⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe
        6⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55630.exe
        7⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64471.exe
        8⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38302.exe
        8⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13871.exe
        7⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54535.exe
        7⤵
        
        PID:17592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
        6⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        7⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
        6⤵
        
        PID:11376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1374.exe
        6⤵
        
        PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41980.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42734.exe
        6⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48925.exe
        7⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7301.exe
        8⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57574.exe
        8⤵
        
        PID:12392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29471.exe
        8⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57274.exe
        7⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53177.exe
        7⤵
        
        PID:16648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47389.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13253.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
        8⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11287.exe
        8⤵
        
        PID:15780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27343.exe
        8⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46894.exe
        7⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44433.exe
        7⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18677.exe
        7⤵
        
        PID:17412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        6⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30756.exe
        7⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58777.exe
        7⤵
        
        PID:16504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31425.exe
        6⤵
        
        PID:12952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17032.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        5⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20166.exe
        6⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        7⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34959.exe
        8⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22821.exe
        8⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47678.exe
        7⤵
        
        PID:11600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20031.exe
        7⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
        6⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11263.exe
        7⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34139.exe
        6⤵
        
        PID:14856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-511.exe
        6⤵
        
        PID:16128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52023.exe
        6⤵
        
        PID:10672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12299.exe
        5⤵
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13194.exe
        6⤵
        
        PID:13924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45584.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18598.exe
        6⤵
        
        PID:8852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55518.exe
        5⤵
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64815.exe
        5⤵
        
        PID:14904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38317.exe
        5⤵
        
        PID:9136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37839.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56169.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31001.exe
        7⤵
        Executes dropped EXE
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12293.exe
        9⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        9⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12719.exe
        9⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42143.exe
        9⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51328.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62270.exe
        9⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49919.exe
        9⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42866.exe
        8⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7413.exe
        8⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8487.exe
        8⤵
        
        PID:15808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        8⤵
        
        PID:17508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe
        7⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        8⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        8⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60060.exe
        9⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56737.exe
        9⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23013.exe
        9⤵
        
        PID:17884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28571.exe
        8⤵
        
        PID:13356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        8⤵
        
        PID:16688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13074.exe
        7⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36736.exe
        8⤵
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
        7⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        7⤵
        
        PID:16676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        6⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exe
        8⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        9⤵
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15896.exe
        9⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
        9⤵
        
        PID:17484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42285.exe
        8⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18672.exe
        9⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54136.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61935.exe
        8⤵
        
        PID:17728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe
        7⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60060.exe
        8⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        8⤵
        
        PID:16036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63190.exe
        8⤵
        
        PID:17432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39707.exe
        7⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        7⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe
        6⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13253.exe
        7⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17948.exe
        8⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30591.exe
        8⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13118.exe
        8⤵
        
        PID:17920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52949.exe
        7⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59809.exe
        7⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53270.exe
        7⤵
        
        PID:17700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        6⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61624.exe
        7⤵
        
        PID:17424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        6⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60808.exe
        6⤵
        
        PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        6⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48925.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
        8⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10873.exe
        9⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25334.exe
        9⤵
        
        PID:17684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        8⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21655.exe
        8⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19750.exe
        8⤵
        
        PID:17436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57274.exe
        7⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8864.exe
        7⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62848.exe
        6⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29511.exe
        7⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15083.exe
        8⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14464.exe
        8⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4812.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17152.exe
        7⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13197.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28171.exe
        6⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64855.exe
        7⤵
        
        PID:13388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31376.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
        6⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16373.exe
        6⤵
        
        PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16531.exe
        5⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62838.exe
        6⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49271.exe
        7⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe
        7⤵
        
        PID:15228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15228 -s 76
        8⤵
        Program crash
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45584.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34359.exe
        7⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23946.exe
        6⤵
        
        PID:9584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
        6⤵
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45023.exe
        6⤵
        
        PID:8116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        5⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60060.exe
        6⤵
        
        PID:12160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5528.exe
        6⤵
        
        PID:16016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12261.exe
        6⤵
        
        PID:18216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58613.exe
        5⤵
        
        PID:11616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17032.exe
        5⤵
        
        PID:16064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48124.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55017.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
        6⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62656.exe
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe
        8⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34487.exe
        9⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32232.exe
        9⤵
        
        PID:15688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31181.exe
        9⤵
        
        PID:17872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64294.exe
        8⤵
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53280.exe
        8⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28171.exe
        7⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35570.exe
        8⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50519.exe
        8⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe
        7⤵
        
        PID:13324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2128.exe
        7⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe
        7⤵
        
        PID:18044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12293.exe
        7⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6790.exe
        8⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52601.exe
        8⤵
        
        PID:15624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        8⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4818.exe
        7⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe
        7⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35497.exe
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4069.exe
        7⤵
        
        PID:17796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        6⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44004.exe
        7⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58777.exe
        7⤵
        
        PID:16552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19701.exe
        6⤵
        
        PID:11304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17909.exe
        6⤵
        
        PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52360.exe
        5⤵
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33902.exe
        6⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
        7⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43072.exe
        8⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40002.exe
        8⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20509.exe
        8⤵
        
        PID:17116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10469.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9913.exe
        7⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-918.exe
        7⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8463.exe
        6⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57662.exe
        7⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26831.exe
        7⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10606.exe
        7⤵
        
        PID:18056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52850.exe
        6⤵
        
        PID:9468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        6⤵
        
        PID:13560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
        6⤵
        
        PID:15956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        5⤵
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13253.exe
        6⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60060.exe
        7⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7926.exe
        7⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55358.exe
        6⤵
        
        PID:11196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13871.exe
        6⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20238.exe
        6⤵
        
        PID:11140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2868.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9918.exe
        5⤵
        
        PID:16872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48681.exe
        5⤵
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28910.exe
        6⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28799.exe
        7⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33453.exe
        7⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59238.exe
        7⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39114.exe
        6⤵
        
        PID:9460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        6⤵
        
        PID:13832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        6⤵
        
        PID:16836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8655.exe
        5⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
        6⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe
        7⤵
        
        PID:18352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3957.exe
        6⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64344.exe
        6⤵
        
        PID:16516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44293.exe
        5⤵
        
        PID:9516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-415.exe
        6⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
        5⤵
        
        PID:15128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18662.exe
        5⤵
        
        PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54655.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40446.exe
        5⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30543.exe
        6⤵
        
        PID:12376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55763.exe
        6⤵
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20509.exe
        6⤵
        
        PID:17108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23946.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18590.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47948.exe
      4⤵
      PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
      4⤵
      PID:11592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24207.exe
      4⤵
      PID:16580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51177.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28889.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
        7⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        8⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4294.exe
        9⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        10⤵
        
        PID:11876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
        10⤵
        
        PID:16524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33453.exe
        9⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5373.exe
        8⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        8⤵
        
        PID:13744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3598.exe
        8⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2900.exe
        7⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60060.exe
        8⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        8⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        8⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10873.exe
        7⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36456.exe
        8⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        7⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5709.exe
        7⤵
        
        PID:9820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2796.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        7⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe
        8⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8775.exe
        9⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        8⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
        8⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16524.exe
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47102.exe
        7⤵
        
        PID:14440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23765.exe
        7⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48924.exe
        6⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16738.exe
        6⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        6⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49864.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31982.exe
        6⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        7⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53549.exe
        7⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59617.exe
        7⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42798.exe
        7⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-677.exe
        7⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
        7⤵
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43975.exe
        7⤵
        
        PID:18084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe
        6⤵
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        6⤵
        
        PID:15944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17491.exe
        5⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        6⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3334.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23631.exe
        8⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        8⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18077.exe
        7⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
        7⤵
        
        PID:16668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        6⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        6⤵
        
        PID:13932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42143.exe
        6⤵
        
        PID:17144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63341.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe
        6⤵
        
        PID:12068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5528.exe
        6⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28789.exe
        6⤵
        
        PID:18180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8073.exe
        5⤵
        
        PID:10796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe
        5⤵
        
        PID:17364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55816.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55209.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
        6⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32745.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
        8⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        8⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10237.exe
        8⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53549.exe
        7⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23745.exe
        7⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40102.exe
        7⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49309.exe
        6⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
        7⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57400.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
        7⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42425.exe
        7⤵
        
        PID:15764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8274.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe
        6⤵
        
        PID:14840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe
        6⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        6⤵
        
        PID:17780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43719.exe
        5⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        6⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe
        7⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31799.exe
        8⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56737.exe
        8⤵
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
        8⤵
        
        PID:17932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe
        7⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13541.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60961.exe
        6⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4069.exe
        6⤵
        
        PID:17752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16443.exe
        5⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6790.exe
        6⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13194.exe
        6⤵
        
        PID:13760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63270.exe
        6⤵
        
        PID:8684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24419.exe
        5⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        5⤵
        
        PID:14912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26062.exe
        5⤵
        
        PID:17200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32537.exe
        5⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        6⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        7⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22632.exe
        8⤵
        
        PID:16104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
        7⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        7⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54574.exe
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45286.exe
        6⤵
        
        PID:17896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14518.exe
        5⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20002.exe
        6⤵
        
        PID:15500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5394.exe
        5⤵
        
        PID:11240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
        5⤵
        
        PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
      4⤵
      PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27561.exe
        5⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58046.exe
        6⤵
        
        PID:11272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19749.exe
        6⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        5⤵
        
        PID:10904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41943.exe
        5⤵
        
        PID:17328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62263.exe
      4⤵
      PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5846.exe
        5⤵
        
        PID:12720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6014.exe
        5⤵
        
        PID:9044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60038.exe
      4⤵
      PID:11356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51010.exe
      4⤵
      PID:6424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43886.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
        5⤵
        
        PID:312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61198.exe
        6⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7486.exe
        8⤵
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31376.exe
        8⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33069.exe
        7⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53280.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35390.exe
        6⤵
        
        PID:17460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        5⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59172.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
        7⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
        6⤵
        
        PID:14428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28493.exe
        6⤵
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50158.exe
        5⤵
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10296.exe
        5⤵
        
        PID:15768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48510.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13336.exe
        6⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50247.exe
        7⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16960.exe
        7⤵
        
        PID:16636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4743.exe
        6⤵
        
        PID:15456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8445.exe
        5⤵
        
        PID:9224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24129.exe
        5⤵
        
        PID:13720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28672.exe
        5⤵
        
        PID:16624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27005.exe
      4⤵
      PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        5⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10293.exe
        6⤵
        
        PID:13060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4551.exe
        6⤵
        
        PID:15444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
        5⤵
        
        PID:11212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53280.exe
        5⤵
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64292.exe
      4⤵
      PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41448.exe
        5⤵
        
        PID:9828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
      4⤵
      PID:12440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49000.exe
      4⤵
      PID:17132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50720.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
        5⤵
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56289.exe
        6⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21614.exe
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58046.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3311.exe
        8⤵
        
        PID:16148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18126.exe
        8⤵
        
        PID:18192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
        7⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exe
        7⤵
        
        PID:15668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37047.exe
        7⤵
        
        PID:17860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53549.exe
        6⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4798.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6974.exe
        7⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23745.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3976.exe
        6⤵
        
        PID:16544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-108.exe
        5⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43072.exe
        6⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        6⤵
        
        PID:13000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26281.exe
        6⤵
        
        PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24204.exe
        5⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29111.exe
        6⤵
        
        PID:13904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
        6⤵
        
        PID:16496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30470.exe
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17615.exe
        5⤵
        
        PID:6496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
      4⤵
      PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
        5⤵
        
        PID:7204
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7204 -s 464
        6⤵
        Program crash
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23946.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
        5⤵
        
        PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61935.exe
        5⤵
        
        PID:17688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41436.exe
      4⤵
      PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7403.exe
        5⤵
        
        PID:14496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25128.exe
        5⤵
        
        PID:16612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19701.exe
      4⤵
      PID:11288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
      4⤵
      PID:8968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60799.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23238.exe
      4⤵
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        5⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6841.exe
        5⤵
        
        PID:12320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42233.exe
        5⤵
        
        PID:16060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
      4⤵
      PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
        5⤵
        
        PID:11900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38686.exe
        5⤵
        
        PID:8760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe
      4⤵
      PID:7664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
      4⤵
      PID:8164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62733.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36201.exe
      4⤵
      PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe
        5⤵
        
        PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        5⤵
        
        PID:12992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        5⤵
        
        PID:16512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36042.exe
      4⤵
      PID:9192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48917.exe
      4⤵
      PID:12348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51833.exe
      4⤵
      PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
      4⤵
      PID:17580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53862.exe
    3⤵
    PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43838.exe
      4⤵
      PID:14460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59238.exe
      4⤵
      PID:7840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
    3⤵
    PID:9576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
    3⤵
    PID:15172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28344.exe
    3⤵
    PID:6492
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51293.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51293.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6599.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20897.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47342.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30726.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64929.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12293.exe
        8⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34092.exe
        9⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2613.exe
        9⤵
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43095.exe
        9⤵
        
        PID:17212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44782.exe
        8⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
        8⤵
        
        PID:17504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58453.exe
        7⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe
        7⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26375.exe
        7⤵
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3263.exe
        6⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63798.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61118.exe
        8⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28097.exe
        8⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4453.exe
        8⤵
        
        PID:17908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44782.exe
        7⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27137.exe
        7⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4069.exe
        7⤵
        
        PID:17788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        6⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        7⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47521.exe
        7⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19701.exe
        6⤵
        
        PID:11384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe
        6⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26127.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23129.exe
        6⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47684.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2390.exe
        8⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
        8⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19701.exe
        7⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27605.exe
        7⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63719.exe
        6⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34295.exe
        7⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46847.exe
        7⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5394.exe
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59504.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1286.exe
        6⤵
        
        PID:18108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20755.exe
        5⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61857.exe
        6⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
        7⤵
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
        7⤵
        
        PID:13336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42425.exe
        7⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-402.exe
        6⤵
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        7⤵
        
        PID:18012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        6⤵
        
        PID:15520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        6⤵
        
        PID:18204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61421.exe
        5⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45112.exe
        6⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41493.exe
        5⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63915.exe
        5⤵
        
        PID:15164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4023.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18239.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38894.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40233.exe
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41628.exe
        7⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-136.exe
        8⤵
        
        PID:15644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25564.exe
        7⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        7⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        6⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59477.exe
        7⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
        7⤵
        
        PID:15120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51336.exe
        7⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36734.exe
        7⤵
        
        PID:17712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27385.exe
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57299.exe
        6⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
        6⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3263.exe
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3637.exe
        6⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
        7⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33069.exe
        7⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45112.exe
        7⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61891.exe
        6⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60060.exe
        7⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56929.exe
        7⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21477.exe
        7⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33841.exe
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        6⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15099.exe
        5⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12405.exe
        6⤵
        
        PID:10968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13295.exe
        6⤵
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30903.exe
        6⤵
        
        PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-957.exe
        5⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        5⤵
        
        PID:15180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64599.exe
        5⤵
        
        PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64367.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        5⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52065.exe
        6⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42063.exe
        7⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37520.exe
        7⤵
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5054.exe
        7⤵
        
        PID:18064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15902.exe
        6⤵
        
        PID:7676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        5⤵
        
        PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36490.exe
        5⤵
        
        PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        5⤵
        
        PID:18068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10092.exe
      4⤵
      PID:5916
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 468
        5⤵
        Program crash
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
      4⤵
      PID:8240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37282.exe
      4⤵
      PID:12956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61000.exe
      4⤵
      PID:16632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56676.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54441.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32366.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        7⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52096.exe
        7⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53738.exe
        7⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18398.exe
        7⤵
        
        PID:17260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
        6⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
        7⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23494.exe
        7⤵
        
        PID:17232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5668.exe
        6⤵
        
        PID:11400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57135.exe
        6⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56029.exe
        5⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54286.exe
        6⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
        7⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        7⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
        6⤵
        
        PID:11004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exe
        6⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13886.exe
        6⤵
        
        PID:17612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        5⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
        5⤵
        
        PID:11608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18855.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
        5⤵
        
        PID:17448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10668.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13445.exe
        6⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30159.exe
        7⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23494.exe
        7⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65103.exe
        6⤵
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        5⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
        6⤵
        
        PID:11760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        6⤵
        
        PID:15988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31425.exe
        5⤵
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
        5⤵
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4227.exe
      4⤵
      PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55246.exe
        5⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7486.exe
        6⤵
        
        PID:14368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31848.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exe
        6⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        5⤵
        
        PID:10844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exe
        5⤵
        
        PID:15484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21727.exe
      4⤵
      PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
      4⤵
      PID:11296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54176.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
      4⤵
      Executes dropped EXE
      PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18447.exe
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        5⤵
        
        PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60949.exe
        5⤵
        
        PID:8336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28571.exe
        5⤵
        
        PID:10332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exe
        5⤵
        
        PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
      4⤵
      PID:9616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60034.exe
      4⤵
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55149.exe
      4⤵
      PID:18096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61567.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-928.exe
      4⤵
      PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        5⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33719.exe
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6974.exe
        6⤵
        
        PID:9552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51331.exe
        5⤵
        
        PID:11232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36368.exe
        5⤵
        
        PID:16076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14436.exe
      4⤵
      PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31415.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58777.exe
        5⤵
        
        PID:16484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28379.exe
      4⤵
      PID:13500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49622.exe
      4⤵
      PID:7572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exe
    3⤵
    PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
      4⤵
      PID:7080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60949.exe
      4⤵
      PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35063.exe
        5⤵
        
        PID:12092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48569.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exe
        5⤵
        
        PID:18120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28571.exe
      4⤵
      PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36734.exe
      4⤵
      PID:17720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62793.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55572.exe
    3⤵
    PID:9656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43376.exe
    3⤵
    PID:16600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2571.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2571.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1213.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10144.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4384.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        6⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        7⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62659.exe
        8⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        8⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3782.exe
        8⤵
        
        PID:18396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29877.exe
        7⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3592.exe
        7⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18677.exe
        7⤵
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9532.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22935.exe
        7⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44798.exe
        7⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
        7⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe
        6⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7413.exe
        6⤵
        
        PID:14896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34429.exe
        6⤵
        
        PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
        5⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36310.exe
        6⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6022.exe
        7⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        8⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
        8⤵
        
        PID:16532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59686.exe
        7⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12533.exe
        7⤵
        
        PID:17228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44014.exe
        6⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41237.exe
        6⤵
        
        PID:14448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53873.exe
        6⤵
        
        PID:16692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16635.exe
        5⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52482.exe
        6⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 460
        7⤵
        Program crash
        
        PID:10476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe
        6⤵
        
        PID:18076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34118.exe
        5⤵
        
        PID:8628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2327.exe
        5⤵
        
        PID:15476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36262.exe
        5⤵
        
        PID:18292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47358.exe
        5⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34973.exe
        7⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
        7⤵
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60769.exe
        7⤵
        
        PID:15608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36042.exe
        6⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exe
        7⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9913.exe
        6⤵
        
        PID:11936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        6⤵
        
        PID:8280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19044.exe
        5⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56676.exe
        6⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37698.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19173.exe
        6⤵
        
        PID:7604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42866.exe
        5⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7413.exe
        5⤵
        
        PID:14936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
        5⤵
        
        PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15462.exe
      4⤵
      PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
        5⤵
        
        PID:6968
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 488
        6⤵
        Program crash
        
        PID:8196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        5⤵
        
        PID:10924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21463.exe
        5⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
        5⤵
        
        PID:17608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14628.exe
      4⤵
      PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
      4⤵
      PID:9212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17032.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24020.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22292.exe
      4⤵
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33902.exe
        5⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        6⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26703.exe
        7⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        7⤵
        
        PID:16304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47430.exe
        7⤵
        
        PID:18280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5772.exe
        6⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-150.exe
        6⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8445.exe
        5⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        5⤵
        
        PID:15632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17596.exe
      4⤵
      PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11257.exe
        6⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43694.exe
        6⤵
        
        PID:11484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
        5⤵
        
        PID:12728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63078.exe
        5⤵
        
        PID:8244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65509.exe
      4⤵
      PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        5⤵
        
        PID:8744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63894.exe
      4⤵
      PID:13824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25648.exe
      4⤵
      PID:17224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63599.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
      4⤵
      PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13336.exe
        5⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18856.exe
        6⤵
        
        PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        5⤵
        
        PID:10932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11287.exe
        5⤵
        
        PID:15824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61463.exe
        5⤵
        
        PID:18344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63509.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61432.exe
        5⤵
        
        PID:10304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe
      4⤵
      PID:12664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48854.exe
      4⤵
      PID:9952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21327.exe
    3⤵
    PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39102.exe
      4⤵
      PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49935.exe
        5⤵
        
        PID:9532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27137.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54230.exe
        5⤵
        
        PID:17624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63038.exe
      4⤵
      PID:8448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5895.exe
      4⤵
      PID:7720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13118.exe
      4⤵
      PID:17940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47188.exe
    3⤵
    PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
      4⤵
      PID:14240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exe
      4⤵
      PID:16856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60038.exe
    3⤵
    PID:10776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16903.exe
    3⤵
    PID:17184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50985.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13237.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
        5⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10933.exe
        6⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27561.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
        8⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21480.exe
        8⤵
        
        PID:16364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6869.exe
        8⤵
        
        PID:17768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24839.exe
        7⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63509.exe
        6⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9343.exe
        7⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8487.exe
        6⤵
        
        PID:15832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3486.exe
        6⤵
        
        PID:10488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62848.exe
        5⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43072.exe
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        6⤵
        
        PID:13012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42233.exe
        6⤵
        
        PID:16032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
        5⤵
        
        PID:8588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4533.exe
        5⤵
        
        PID:13860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33661.exe
        5⤵
        
        PID:7080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44405.exe
      4⤵
      PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61198.exe
        5⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        6⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
        7⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65097.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22821.exe
        7⤵
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
        6⤵
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19160.exe
        6⤵
        
        PID:15716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27333.exe
        6⤵
        
        PID:17648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-402.exe
        5⤵
        
        PID:10976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe
        5⤵
        
        PID:16000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53741.exe
      4⤵
      PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33719.exe
        5⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5246.exe
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34388.exe
      4⤵
      PID:8132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
      4⤵
      PID:5868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58717.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
      4⤵
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36009.exe
        5⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        6⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        7⤵
        
        PID:14060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58777.exe
        7⤵
        
        PID:16588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        6⤵
        
        PID:12356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48008.exe
        6⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
        5⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55845.exe
        5⤵
        
        PID:13752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26575.exe
        5⤵
        
        PID:9688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-596.exe
      4⤵
      PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9094.exe
        5⤵
        
        PID:8372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21061.exe
        5⤵
        
        PID:14996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26487.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20473.exe
      4⤵
      PID:9324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40662.exe
      4⤵
      PID:15004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16463.exe
      4⤵
      PID:16140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe
      4⤵
      PID:17736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57647.exe
    3⤵
    PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63798.exe
      4⤵
      PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60060.exe
        5⤵
        
        PID:12188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39830.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
      4⤵
      PID:10868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5127.exe
      4⤵
      PID:15704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55853.exe
    3⤵
    PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25092.exe
      4⤵
      PID:14680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10992.exe
      4⤵
      PID:15508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61822.exe
      4⤵
      PID:17952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
    3⤵
    PID:11340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6480
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2091.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2091.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37550.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49065.exe
      4⤵
      PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36009.exe
        5⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
        6⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18269.exe
        6⤵
        
        PID:12836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
        6⤵
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6014.exe
        6⤵
        
        PID:10648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53614.exe
        5⤵
        
        PID:9404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        5⤵
        
        PID:12548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2708.exe
      4⤵
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2390.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6974.exe
        5⤵
        
        PID:8800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36229.exe
      4⤵
      PID:11224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8581.exe
      4⤵
      PID:5876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe
    3⤵
    PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55630.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        5⤵
        
        PID:12476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6974.exe
        5⤵
        
        PID:10052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
      4⤵
      PID:10940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
      4⤵
      PID:17240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
    3⤵
    PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27520.exe
      4⤵
      PID:18364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19701.exe
    3⤵
    PID:10620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23765.exe
    3⤵
    PID:7612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44263.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44263.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
    3⤵
    PID:228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17177.exe
      4⤵
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe
        5⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64294.exe
        5⤵
        
        PID:10632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27917.exe
        5⤵
        
        PID:9100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14436.exe
      4⤵
      PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exe
        5⤵
        
        PID:13788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31376.exe
        5⤵
        
        PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28379.exe
      4⤵
      PID:13492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-421.exe
      4⤵
      PID:7420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
    3⤵
    PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54372.exe
      4⤵
      PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18269.exe
      4⤵
      PID:12844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53280.exe
      4⤵
      PID:6356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43613.exe
    3⤵
    PID:9372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32795.exe
    3⤵
    PID:13568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23765.exe
    3⤵
    PID:7616
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
  2⤵
  PID:5200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
    3⤵
    PID:7212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
    3⤵
    PID:8376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23296.exe
      4⤵
      PID:11460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28571.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28571.exe
    3⤵
    PID:12460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8487.exe
    3⤵
    PID:15816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61151.exe
    3⤵
    PID:18416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1299.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1299.exe
  2⤵
  PID:6676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11051.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11051.exe
    3⤵
    PID:11812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6974.exe
    3⤵
    PID:6860
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50237.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50237.exe
  2⤵
  PID:11204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31134.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31134.exe
  2⤵
  PID:17740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5916 -ip 5916
1⤵
PID:5464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6968 -ip 6968
1⤵
PID:8612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6996 -ip 6996
1⤵
PID:8948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7204 -ip 7204
1⤵
PID:9204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 7240 -ip 7240
1⤵
PID:9652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 13764 -ip 13764
1⤵
PID:14364

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10144.exe

Filesize
468KB

MD5
e7f554de30c1eb7c1ec1c1e43c2799ba

SHA1
53dae9156bd75333feba83a95e90e4d6946d7858

SHA256
4720dd54ee5edd50fd4da0094bfe22077498f02d5a761a7cdff1ce2fecee2002

SHA512
cde4d54cc59884e5c0de309c01b8d533c6d6d3683782eb21207d42fbf8bd56d842f1051cb764e01149720e100ef8afb50396d49b450444f08e1670904aa4d6b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1213.exe

Filesize
468KB

MD5
6d70cd5ac688e3592da3976fdd34f7e1

SHA1
44124ef453f69808ed5e14fb39e104181938af93

SHA256
5bced66d6f19f8d8ba86017238670928d08fbd0fbc67712d06cf7fa977fb108c

SHA512
da42138c53e7ecd093bdcb057901f075d0662d2ea481a6ceac9d2e7aef83c6d7ee2a8ba07706a3367c7bcbe34621171380ce521048704a946f8994a947a1a9f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18239.exe

Filesize
468KB

MD5
a39e66584277378d75d64bc3e5e91334

SHA1
27a7999e40566686e92bd8564c7266217172c634

SHA256
c8ec264d4a7adc6f9970b824d32dfb35bc25c9e82445f428bdc5c38b0ecb9e24

SHA512
d054553a8791b59eed389329ad26dfd389a3d6052ed0e0fe0775b1ecceea506431ebff468ee2c6f66286a28f20adf1571c5d35fe586e996cc156e003647ee422

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe

Filesize
468KB

MD5
72cb990a0ff6ea6bb2a23c3e62caacac

SHA1
23bf71e4668a849433a1ab2083f202e71de592c3

SHA256
bd18c9d9c00c5e22c4340b8992f59a097a9290aacb38c760c99b4ce0efbc88c5

SHA512
ce85ea463a46ca9989ec8574c198c9f57d6ab20f42c5b8ae69b43024708221c2638561a37719e49e5c809c300af91d35c91fa05fb3caffce3b549d377ec0c159

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20897.exe

Filesize
468KB

MD5
739a8d0e5454461140f243898aeb16a9

SHA1
092e585c5e3fba7b76a745c417a1f8eb0cdfde70

SHA256
a5acc1678995d697a893537c595803453b5d9f5d492157174ff3290bd9699ca5

SHA512
79474805d66740c31af61adfbab031445d0c02ba945d2c2a2adbfcf84fc987f522fd3534eb1e04d9df734436ffb23d2df1afb195016ce53dba3260342c4a4040

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2091.exe

Filesize
468KB

MD5
b0af3fd230638b84db7dba9ca8515d45

SHA1
cf972acd84cc1544d851658f5c2d479e230e52a1

SHA256
d8be183a4fd413706537a7132b38e3d9379d4801b065d2dbeab1fd5c790b4c68

SHA512
b15dbad058c16f21488fd8a886713f273ad96fa80830643981e9586beef9a7326e99414a5c9e9422c871acd61832457c99bbe1761017aa3579b1ff9b20ca59c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21857.exe

Filesize
468KB

MD5
bf331dfb2324dd6500552060ede29a05

SHA1
27b2c1b6bd723238303da2640be7236b03659079

SHA256
bd88d6c460116d16237c2e502a594f023dac978aae72da30b5d0eb62b43ed944

SHA512
98566b9d609ceca5c73fcc07aaf28380f91f60f3ffe3e532f2fddda0031a7ea964eec05159b435eb1ef69e237b4fca90ab4c15456ead8402632f45118deb7008

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24020.exe

Filesize
468KB

MD5
1cf999f95c5aa13980a1e9ae431632b2

SHA1
ea45059c1d5af06c056c576ebddf626a1c4198b6

SHA256
9c414f05912f322dafe5b7e5ef7bfc2489265e44c72534ed9b20af2ecf5e9417

SHA512
cfdc8bd315b0c894bcddffee519e2f59baee7ff2a829797591b29c6655cde8762353b1f6b218d11e1ee34cb0108daecbcedd5940c7016a376ba7ad6d53f5da1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe

Filesize
468KB

MD5
07270eb50cf80bb4d0e946f6d6ffed68

SHA1
78e58cefe71183376b4a88d10551aa57a997f8d4

SHA256
b3d0e60db59b4b45288af6396033deeb3faf8f0d065a291b0a4ac137d225759a

SHA512
7fd626a4bedc6faf560d56f442d9d771ff5575ae1ca08cae2a0a19bd291c5ed8d4db2a4030e4b17996bc641fc1aa8945403227da4319f74e1a993f54c5147d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2571.exe

Filesize
468KB

MD5
2aaf65feeef105e7319611d3c1153467

SHA1
f653536011fc6a6a48a3b501629c7419b52134c4

SHA256
693bf82c90e60ac1fcecd8b9a78894c54a8100f5b69dfda73de98be5e5c62a29

SHA512
bd20a61f3ff9553a8342d0ceb35fce6671f4dcb97e66ae9da541102b21b58c488483367a7a04958951fe9f2864a7dd10cb107a61f0fae0ca55c477df617685c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37417.exe

Filesize
468KB

MD5
127d2b37387ec3c14cb1d9d19e7064e5

SHA1
9d4b73e52c2fdf56ac59c242f46beab7b503ed9b

SHA256
0493953991c9772135ca3430ebb40b10aac467182b949a1b2a350f507bbda041

SHA512
481efa559c802ad4ad278978392d180d7199cd4f39421077127111d1bea507074767e5bc81cec1d9747eaf70f49e7c7d2c83d7e929cbff8b512533cfcff0f32f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37839.exe

Filesize
468KB

MD5
a0fb5e79ef9fde93fb73e074aa72ca18

SHA1
798370d30f330e8d60fd9d1127e8b70aee966cf2

SHA256
e71855b0eba3e3b290cd3de3272476837b6aa47bce8d3d56339cadf986a712ab

SHA512
3fe2dd4b73ada98b0bc32c94e680872ebbf024e6814cfce399dc825fa7dc9eb05e1ffe9cf9e2fafc3ace15871558eab1c12ac579ca9dc132b42ea838bce40b7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40002.exe

Filesize
468KB

MD5
96cc0082c384155070f9ba464feb92a5

SHA1
bb1ec166cc955148ddf14410a3eb260671ba567a

SHA256
8d459b124b38c7bb485eafb397b13fd86f21b8d43bc469707cc4e465cf2e26ab

SHA512
9d3ce022a5b53350716206d77e4dbd942ba1d038ea2d4b4be4558961fe6f78c220ebd238e3c24136f40a09b219144dfab9bb362e46cf0b26630f318651d1e03e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exe

Filesize
468KB

MD5
8ce91bfe3d6646c9d88b27aa5f51cbc8

SHA1
1102206017e65be98c7a5ae57ccfeff1bd613b71

SHA256
766bffad3a2a0953fec7540349309820ddc7565fd270783fdc606a057afe822f

SHA512
439084ab4aab74b18ac68c34472688bca1795030d3d581d39a33174aae692d116454a9944e19145ab26fd82819e6f8c0cfbb230e0b0508c7ee4074b7778b63ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43886.exe

Filesize
468KB

MD5
05fcd4bd373651cadb5967c83db9419e

SHA1
b44a20333776c081af7f2984d0c0c9691861f6e2

SHA256
d6c17694127da2290ff612983a078923d783c0a381fa2a43a2f3774c63778898

SHA512
b4fcdc92d789d0e09fb5a6bf6d86adbc0dffa33ade60e7f7417e2227621349da1b1e99b04d09e03fce5cd818c60045da39c9a8b10d9d9426a87f8f7a72ad2029

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe

Filesize
468KB

MD5
1580d0521130fd2b7b161c1a3d9d32a6

SHA1
6772bcc6d67f8c92132d3a11c95feab743edcef5

SHA256
b8ed59e0f3276130d01e97273466bd68726d21cfa59d28329b558fa6370b1be7

SHA512
1f7f84d168d09eb9e31f4b0d2190a237e5f80bac79c8fcdde5bb3ee045f62c96860da7affe61a0ec8d8a20f3ff7f229742ea22f09bf25f03c2e9e5300323a38e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47342.exe

Filesize
468KB

MD5
3896d24680b31f453c47ada654f2f86a

SHA1
b7a8b1ed2b0ef61e196f5ed5c8bdba02a34b16dd

SHA256
ed151d4c61beff935fa076265f5a120523f0bc253d1ac73e885cd7eadc655b39

SHA512
51f457caa195c21fd5c80e85a706b347e7d5ca5c3e10dabbf8c080f4faa0b2c357b944742eb09f8e7e222adfef80e1ea0be7d294c1a00271845ff70d50005c55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48124.exe

Filesize
468KB

MD5
2f45db159ca8e016b4531828bd5773b1

SHA1
a8041133c22d76c117324e7ec4be507aef823da5

SHA256
377fbae390a3d795f836df8f0b784b2ebf9426188757ae8be8add09191891e00

SHA512
4b9f9e1cf9312449998e76e11fc9e1f600171afbee50f3176647baad85e85a49ca6634370ded7bfe6203042aee24b0656ba15e2a70e56d8220cf89a2d80a7c05

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50720.exe

Filesize
468KB

MD5
72afc3a7b0688fbf34be6bceb90e2de8

SHA1
b83973901cde4a8bc442adb9fa10f3b58d07fe8c

SHA256
fcde70f9d4cb0907229f1fa9adc3a2e821d2475b61bd1d41a9035b4518a26bb0

SHA512
95f6cb1ceef552f14fedf502c9debb04bdcc1b89798f07cfbb8b840a13700c86b483b3154e0b3bf01652fa829eab5495052a64df693f93a1d26dc9eb9cbb0d9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50985.exe

Filesize
468KB

MD5
02cf36be8bbc4f0764eaa2fdcbddce33

SHA1
c5a15f08e3b58ac7c59b5859cd1e53a9e2268cd7

SHA256
d90e9b6d43d10b18e6a6751bc865eea6b4ed97818fc0b6efddeaa4e075fc11af

SHA512
8fb99f055d025e13a4e261b80e7fe5eb69a3e5e99960100cf54a014094224b12878c62e85343325e35a7157e61f5243a4f9e8bc200825bfc52b3f68f957ec8cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51177.exe

Filesize
468KB

MD5
1dfdc73898f84f5942202e96b0412877

SHA1
8e4cbb026858f09d48e7bf35861ebe6823d4ad4c

SHA256
ad0cbd5dce1f213228fc2539c110f1f5719a9bed58b3d7f30c0d63218ee32f8d

SHA512
1bb05d6957b72a9da17dcb0a47c3bbb080b8fa8a40ff242d1df5140a563c4180f09e6e68abc979137c0591eb8cb50cbbcc7b55fbe6a180970ab19626b9f82448

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51293.exe

Filesize
468KB

MD5
2901a2f0f5e6094fff45777e6f81645e

SHA1
b66e66643c85a889c012fdba3b55a08f342533b4

SHA256
1cfd0e882fff60975b04a5ca71e71a35ac182319dbb68b523ec5432013fdbf8b

SHA512
81dc9b6678e8113ee74ff54b9e54f63e998069204f8ee2ebcf7b6f3756bf650108b81099ef370fd66be58aca9d789fe8ee5dd926ca242457d5a00d9f0bba9be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54176.exe

Filesize
468KB

MD5
fd458d1f7015230f3d391a379b055c5c

SHA1
ded2f4c06c54d8b06b63f72d2fd59e045aa3149e

SHA256
a382feec08c51578c58b1fc3ccd534773f7a3d9b05f8fbf2fe778d724270f565

SHA512
ce387e092fdc2c7e55583a8571c191b727b04a3963510b3919c84843c470498ed18a341ec6db88928329357e9da954c27ba5d8760e9676e11f0b7f3b655f2f73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe

Filesize
468KB

MD5
56a7b87bd351d9cd19365006eeb73f75

SHA1
d651b379132355930f8690526f4abfdd7ddf9039

SHA256
31de4b78cb5908f6ecdb26f4e13cd9cf1e1db76a644b50d384b32f20952d0ca7

SHA512
ba98cd038aa67f6cb2df9ddc309c184d15aefd32111ab4cf8bacf6c66c526a38d867a382afd4217d17c7c3dd63e20f8a199cd7ff35ae1518f8452fea94f158b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54441.exe

Filesize
468KB

MD5
01121a9746410cd313e42f2666fa82ca

SHA1
413adad062479b0b36556fda87f992abe2fb24f2

SHA256
e6232701eedf9f50673cc20cba8586b7794ce2653dc43d01d051182c5853ee6d

SHA512
71b4e5c6aeb4c36d712480fc42eadecc728d60a8546691806a04a53ecd1c4eb584834010d389359af45ba02b746adb60308d7144a107879358dc889ba6b70e28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54526.exe

Filesize
468KB

MD5
65392960ce9c35ae74c196a986695122

SHA1
efb21a24a31470e401dc0931a5be514b19fe5d46

SHA256
bea9e5b1229b4b252b9ae10fcaa52e7431776fd635d9eb79bac2ed36f747ca3a

SHA512
af101b0aa326a90cc13b1b5207358d03cdf966b05ddf92d20a6a300b9cfd652b9d67e994856254557589d23a89ba2295debe835e90c848928ba3a3a94b3536e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55593.exe

Filesize
468KB

MD5
383a23c9d0f8f8ea7b6c4244f6bf9076

SHA1
04865c07b5e8696040e88b1c27c04f8e30b283ad

SHA256
a36562c190ac809db9e15529a6cb037c5015fc979bd02db27da52cb44e71c5b6

SHA512
cd68bb136b84c2a8e7bf1e0550077225ff7ff5949cb664af0486e281fdaf28fe6683a0b01b0d2f5d96f4749c63742843cccd34e4fead1a3418aa17b818c14643

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55816.exe

Filesize
468KB

MD5
604d89e215e0e78d9152f33b602f1a75

SHA1
e1c3b79495cde3652ee3b08e403cab0337b83298

SHA256
81f0490589e1eadefdb45c86e20c479ac817c9e3b69768d57816e2343af3876b

SHA512
7f8939d1e3001a446f670ca1335a5c20f0902aa883c01a21163cd2e747a6e7c80883fdedc857d85832cadf701cb13bb70c59ff0af502d86904cad5d5148e2a26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56676.exe

Filesize
468KB

MD5
bd7435193664d7bae89d1e2ede227815

SHA1
b730fc80e99ea8f266e7f9c781696503e153c35b

SHA256
ad10960461c9d6ad0c55e23f85a956fdf4f8a8e7480e31d9a8de518f6a0f86ad

SHA512
d52ce381678e82492fb1b0de6057659e392241eb22ab5e79df2aaff69fe40fd73a080a55d988a51c67179ebc743e3bc5b93d54f25bc66148de4afa9a06a1274a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe

Filesize
468KB

MD5
d15c50ac5c5a645a7d0d2f72b170ff0d

SHA1
09e9712a1ea4c27cb692fa6de570178adb7afdf5

SHA256
72e9135740c708129a750c8d096098b69f22a2cd0f621694d66d2de476f1f7d4

SHA512
075da3b02ec0d41b58ac169b8e3bd0bc455cf94dc868a57e3f2e956e480d0478f702062bddd128948214e6d3bd1fa6285f45a9ac3ac54f11d7d4f1e3ade84e0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe

Filesize
468KB

MD5
fe9af2ba7c5930fccb3af5ba3946dfe5

SHA1
d68a2fbc3e65ecc74c10c4060403496c96d38f84

SHA256
86e5e9d452617e030158b5754b84818d3c4cf22af33bff03cd7b1e08e9da75b2

SHA512
531eb800c67f06649a4100ffbc09aee112b6f02754064d20873bd11bad5e227d35f8351563c430909d89581993878abc1fb8d3b0611a81cc570358255c80f27a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6599.exe

Filesize
468KB

MD5
cb1ae1df67d2a276846591089ee22a44

SHA1
3ce604023f3ed1c537bbf09eea61090b7b6bc201

SHA256
86931c529b1cdd35b28d942d110026da63d57c6cd7ce7dc795d0c5f139552990

SHA512
5791a0ce208b95d9ba0c5d4f5e97de773bf93b8fe33dbecfebb35678dd3e7f93f9dd70877eac9055db5d6336a46c9d9db5e88419a9dee50d4be1608402d648c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9884.exe

Filesize
468KB

MD5
c0cebd05e54701e2de84ab0f221e8810

SHA1
a14181c1327c53e4bf970b583bad4f768472af71

SHA256
52a5b8e94be6d94c20f60efff3a74e463c7d1ff3b36401879c5233c2606057d3

SHA512
88e5f7ec5439fb3fd312ff04dde7a1c1d31dcf7261f5d3a26c1043df2a48fa774c8a25492ffd680d2889803490721b95466cf70578fa95aa766049c6da78ef96

Download Submit
memory/208-64-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/312-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/368-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/384-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/468-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/492-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/496-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/560-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/648-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/884-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/940-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1040-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1052-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1064-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1240-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1264-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1300-3755-0x0000000075A50000-0x0000000075A5F000-memory.dmp

Filesize
60KB

Download
memory/1300-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1300-3754-0x0000000077030000-0x0000000077054000-memory.dmp

Filesize
144KB

Download
memory/1300-3753-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1380-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1392-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1460-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1472-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1480-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1488-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1544-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1564-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1576-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1796-3752-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1796-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1812-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1824-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1952-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1996-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2024-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2032-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2176-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2316-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2380-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2556-519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2672-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2788-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2864-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3036-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3040-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3168-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3192-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3220-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3244-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3276-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3316-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3456-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3468-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3588-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3684-30-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3704-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3736-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3764-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3772-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3812-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3828-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3836-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3868-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4032-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4116-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4120-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4236-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4252-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4316-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4368-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4404-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4408-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4420-567-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4492-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4560-213-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4584-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4692-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4696-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4864-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4972-58-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4976-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5000-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5008-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5012-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5076-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5080-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-3528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5108-15-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5136-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5184-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5200-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5868-3751-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13240-3421-0x0000000077D90000-0x0000000077D9A000-memory.dmp

Filesize
40KB

Download
memory/13620-3748-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15632-3592-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15692-3740-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/18332-3747-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads