bdacc0669052bd7a8ee4791a5a1ae61f0add0f7eceb7b6505fdae940e66e4796

Analysis

max time kernel
120s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f339b95b50d255debd93f7e29d67eeb0N.exe
Size

184KB
MD5

f339b95b50d255debd93f7e29d67eeb0
SHA1

35e6fedbffb157d43b5cd3d3be8d71b9c99f92d3
SHA256

bdacc0669052bd7a8ee4791a5a1ae61f0add0f7eceb7b6505fdae940e66e4796
SHA512

a6e19d408a4645b72dc093bf03320952d87fda4ca84a2f1fc2b924405fed7dca015e95b52357464e347195df5ae2d3b47f9682efd1d2521c12746e34b2547c32
SSDEEP

3072:RRZa8eo0iAdRd8+OZoF8tr90lvnqnveuo:RRSoqf8+p8l90lPqnveu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2868	Unicorn-54532.exe
4544	Unicorn-8190.exe
916	Unicorn-28056.exe
2064	Unicorn-43130.exe
3200	Unicorn-62996.exe
4128	Unicorn-12818.exe
2912	Unicorn-18949.exe
4632	Unicorn-33780.exe
1736	Unicorn-26166.exe
4604	Unicorn-39902.exe
4296	Unicorn-54200.exe
1040	Unicorn-62368.exe
2392	Unicorn-62103.exe
3088	Unicorn-42502.exe
1968	Unicorn-3930.exe
1852	Unicorn-23604.exe
3364	Unicorn-20074.exe
1492	Unicorn-10967.exe
3204	Unicorn-23220.exe
2980	Unicorn-3354.exe
3568	Unicorn-27304.exe
3476	Unicorn-21173.exe
4064	Unicorn-41092.exe
2340	Unicorn-45176.exe
1416	Unicorn-53344.exe
2164	Unicorn-34961.exe
2040	Unicorn-33478.exe
864	Unicorn-48498.exe
2220	Unicorn-57163.exe
4356	Unicorn-58772.exe
4828	Unicorn-8594.exe
2288	Unicorn-50967.exe
3616	Unicorn-5295.exe
2784	Unicorn-17548.exe
3500	Unicorn-19585.exe
1424	Unicorn-2363.exe
1988	Unicorn-10894.exe
4456	Unicorn-47096.exe
3424	Unicorn-60972.exe
4184	Unicorn-35996.exe
4700	Unicorn-40080.exe
1848	Unicorn-40634.exe
4612	Unicorn-60235.exe
972	Unicorn-43972.exe
956	Unicorn-60308.exe
3148	Unicorn-60308.exe
3916	Unicorn-44527.exe
5100	Unicorn-16261.exe
3688	Unicorn-11107.exe
1776	Unicorn-3494.exe
1556	Unicorn-63431.exe
1960	Unicorn-22597.exe
3196	Unicorn-42803.exe
4320	Unicorn-48933.exe
3052	Unicorn-37650.exe
2128	Unicorn-43780.exe
1360	Unicorn-51683.exe
3396	Unicorn-48632.exe
4692	Unicorn-52716.exe
3868	Unicorn-60619.exe
5008	Unicorn-32850.exe
2940	Unicorn-19660.exe
924	Unicorn-7962.exe
4508	Unicorn-29328.exe

Program crash 27 IoCs

pid	pid_target	Process	procid_target
3092	2040	WerFault.exe	120
6564	5712	WerFault.exe	185
15280	15220	WerFault.exe	709
15648	14528	WerFault.exe	693
17100	15176	WerFault.exe	708
17300	14668	WerFault.exe	723
17348	14104	WerFault.exe	714
17384	14552	WerFault.exe	716
12232	14988	WerFault.exe	733
12116	14376	WerFault.exe	739
6892	7468	WerFault.exe	294
19184	18836	WerFault.exe	1005
6192	17716	WerFault.exe	919
14532	19116	WerFault.exe	1020
5172	5200	WerFault.exe	962
18472	8756	WerFault.exe	367
10792	17528	WerFault.exe	914
7072	18636	WerFault.exe	987
8884	18528	WerFault.exe	981
9596	5360	WerFault.exe	968
12116	18744	WerFault.exe	1023
3164	8536	WerFault.exe	404
11988	18700	WerFault.exe	994
5392	18296	WerFault.exe	1032
19164	5568	WerFault.exe	974
5132	8864	WerFault.exe	449
5624	9736	WerFault.exe	435

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8038.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17820	dwm.exe
Token: SeChangeNotifyPrivilege	17820	dwm.exe
Token: 33	17820	dwm.exe
Token: SeIncBasePriorityPrivilege	17820	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1320	f339b95b50d255debd93f7e29d67eeb0N.exe
2868	Unicorn-54532.exe
916	Unicorn-28056.exe
4544	Unicorn-8190.exe
2064	Unicorn-43130.exe
3200	Unicorn-62996.exe
2912	Unicorn-18949.exe
4128	Unicorn-12818.exe
4632	Unicorn-33780.exe
4296	Unicorn-54200.exe
4604	Unicorn-39902.exe
1736	Unicorn-26166.exe
3088	Unicorn-42502.exe
1040	Unicorn-62368.exe
2392	Unicorn-62103.exe
1968	Unicorn-3930.exe
1852	Unicorn-23604.exe
3364	Unicorn-20074.exe
1492	Unicorn-10967.exe
3204	Unicorn-23220.exe
3476	Unicorn-21173.exe
3568	Unicorn-27304.exe
2980	Unicorn-3354.exe
1416	Unicorn-53344.exe
4064	Unicorn-41092.exe
864	Unicorn-48498.exe
2220	Unicorn-57163.exe
2340	Unicorn-45176.exe
2040	Unicorn-33478.exe
2164	Unicorn-34961.exe
4356	Unicorn-58772.exe
4828	Unicorn-8594.exe
3616	Unicorn-5295.exe
2288	Unicorn-50967.exe
2784	Unicorn-17548.exe
3500	Unicorn-19585.exe
1424	Unicorn-2363.exe
1988	Unicorn-10894.exe
4456	Unicorn-47096.exe
3424	Unicorn-60972.exe
4184	Unicorn-35996.exe
4700	Unicorn-40080.exe
1848	Unicorn-40634.exe
4612	Unicorn-60235.exe
972	Unicorn-43972.exe
956	Unicorn-60308.exe
5100	Unicorn-16261.exe
1776	Unicorn-3494.exe
3196	Unicorn-42803.exe
3688	Unicorn-11107.exe
1556	Unicorn-63431.exe
3916	Unicorn-44527.exe
3148	Unicorn-60308.exe
1960	Unicorn-22597.exe
2128	Unicorn-43780.exe
3052	Unicorn-37650.exe
4320	Unicorn-48933.exe
1360	Unicorn-51683.exe
3868	Unicorn-60619.exe
4692	Unicorn-52716.exe
3396	Unicorn-48632.exe
5008	Unicorn-32850.exe
2940	Unicorn-19660.exe
4508	Unicorn-29328.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2868	1320	f339b95b50d255debd93f7e29d67eeb0N.exe	92
PID 1320 wrote to memory of 2868	1320	f339b95b50d255debd93f7e29d67eeb0N.exe	92
PID 1320 wrote to memory of 2868	1320	f339b95b50d255debd93f7e29d67eeb0N.exe	92
PID 1320 wrote to memory of 4544	1320	f339b95b50d255debd93f7e29d67eeb0N.exe	95
PID 1320 wrote to memory of 4544	1320	f339b95b50d255debd93f7e29d67eeb0N.exe	95
PID 1320 wrote to memory of 4544	1320	f339b95b50d255debd93f7e29d67eeb0N.exe	95
PID 2868 wrote to memory of 916	2868	Unicorn-54532.exe	94
PID 2868 wrote to memory of 916	2868	Unicorn-54532.exe	94
PID 2868 wrote to memory of 916	2868	Unicorn-54532.exe	94
PID 2868 wrote to memory of 2064	2868	Unicorn-54532.exe	98
PID 2868 wrote to memory of 2064	2868	Unicorn-54532.exe	98
PID 2868 wrote to memory of 2064	2868	Unicorn-54532.exe	98
PID 916 wrote to memory of 3200	916	Unicorn-28056.exe	99
PID 916 wrote to memory of 3200	916	Unicorn-28056.exe	99
PID 916 wrote to memory of 3200	916	Unicorn-28056.exe	99
PID 1320 wrote to memory of 4128	1320	f339b95b50d255debd93f7e29d67eeb0N.exe	100
PID 1320 wrote to memory of 4128	1320	f339b95b50d255debd93f7e29d67eeb0N.exe	100
PID 1320 wrote to memory of 4128	1320	f339b95b50d255debd93f7e29d67eeb0N.exe	100
PID 4544 wrote to memory of 2912	4544	Unicorn-8190.exe	101
PID 4544 wrote to memory of 2912	4544	Unicorn-8190.exe	101
PID 4544 wrote to memory of 2912	4544	Unicorn-8190.exe	101
PID 3200 wrote to memory of 4632	3200	Unicorn-62996.exe	102
PID 3200 wrote to memory of 4632	3200	Unicorn-62996.exe	102
PID 3200 wrote to memory of 4632	3200	Unicorn-62996.exe	102
PID 916 wrote to memory of 1736	916	Unicorn-28056.exe	103
PID 916 wrote to memory of 1736	916	Unicorn-28056.exe	103
PID 916 wrote to memory of 1736	916	Unicorn-28056.exe	103
PID 2868 wrote to memory of 4604	2868	Unicorn-54532.exe	104
PID 2868 wrote to memory of 4604	2868	Unicorn-54532.exe	104
PID 2868 wrote to memory of 4604	2868	Unicorn-54532.exe	104
PID 2912 wrote to memory of 4296	2912	Unicorn-18949.exe	105
PID 2912 wrote to memory of 4296	2912	Unicorn-18949.exe	105
PID 2912 wrote to memory of 4296	2912	Unicorn-18949.exe	105
PID 4128 wrote to memory of 1040	4128	Unicorn-12818.exe	106
PID 4128 wrote to memory of 1040	4128	Unicorn-12818.exe	106
PID 4128 wrote to memory of 1040	4128	Unicorn-12818.exe	106
PID 1320 wrote to memory of 2392	1320	f339b95b50d255debd93f7e29d67eeb0N.exe	107
PID 1320 wrote to memory of 2392	1320	f339b95b50d255debd93f7e29d67eeb0N.exe	107
PID 1320 wrote to memory of 2392	1320	f339b95b50d255debd93f7e29d67eeb0N.exe	107
PID 4544 wrote to memory of 3088	4544	Unicorn-8190.exe	108
PID 4544 wrote to memory of 3088	4544	Unicorn-8190.exe	108
PID 4544 wrote to memory of 3088	4544	Unicorn-8190.exe	108
PID 2064 wrote to memory of 1968	2064	Unicorn-43130.exe	109
PID 2064 wrote to memory of 1968	2064	Unicorn-43130.exe	109
PID 2064 wrote to memory of 1968	2064	Unicorn-43130.exe	109
PID 4632 wrote to memory of 1852	4632	Unicorn-33780.exe	110
PID 4632 wrote to memory of 1852	4632	Unicorn-33780.exe	110
PID 4632 wrote to memory of 1852	4632	Unicorn-33780.exe	110
PID 3200 wrote to memory of 3364	3200	Unicorn-62996.exe	111
PID 3200 wrote to memory of 3364	3200	Unicorn-62996.exe	111
PID 3200 wrote to memory of 3364	3200	Unicorn-62996.exe	111
PID 4296 wrote to memory of 1492	4296	Unicorn-54200.exe	112
PID 4296 wrote to memory of 1492	4296	Unicorn-54200.exe	112
PID 4296 wrote to memory of 1492	4296	Unicorn-54200.exe	112
PID 3088 wrote to memory of 3204	3088	Unicorn-42502.exe	113
PID 3088 wrote to memory of 3204	3088	Unicorn-42502.exe	113
PID 3088 wrote to memory of 3204	3088	Unicorn-42502.exe	113
PID 2912 wrote to memory of 2980	2912	Unicorn-18949.exe	114
PID 2912 wrote to memory of 2980	2912	Unicorn-18949.exe	114
PID 2912 wrote to memory of 2980	2912	Unicorn-18949.exe	114
PID 1736 wrote to memory of 3568	1736	Unicorn-26166.exe	115
PID 1736 wrote to memory of 3568	1736	Unicorn-26166.exe	115
PID 1736 wrote to memory of 3568	1736	Unicorn-26166.exe	115
PID 4544 wrote to memory of 3476	4544	Unicorn-8190.exe	116

C:\Users\Admin\AppData\Local\Temp\f339b95b50d255debd93f7e29d67eeb0N.exe
"C:\Users\Admin\AppData\Local\Temp\f339b95b50d255debd93f7e29d67eeb0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54532.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54532.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62996.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33780.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23604.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5295.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19660.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14719.exe
        9⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10282.exe
        10⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21197.exe
        10⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29611.exe
        10⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
        10⤵
        
        PID:18340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39062.exe
        9⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13030.exe
        9⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7410.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53375.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6271.exe
        9⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6995.exe
        10⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36102.exe
        10⤵
        
        PID:14204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34358.exe
        9⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1597.exe
        9⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59238.exe
        8⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34655.exe
        8⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
        8⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        8⤵
        
        PID:19244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7962.exe
        7⤵
        Executes dropped EXE
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7703.exe
        8⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32696.exe
        9⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54904.exe
        10⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29347.exe
        10⤵
        
        PID:19204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23197.exe
        10⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15054.exe
        9⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10917.exe
        9⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        9⤵
        
        PID:18164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
        8⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        9⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60239.exe
        9⤵
        
        PID:17680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9713.exe
        8⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
        8⤵
        
        PID:15732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        8⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14579.exe
        8⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54691.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe
        8⤵
        
        PID:15764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe
        8⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33015.exe
        7⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2009.exe
        7⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38264.exe
        7⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50967.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
        8⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
        9⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
        9⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        9⤵
        
        PID:15712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        9⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5360 -s 436
        10⤵
        Program crash
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21285.exe
        8⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13789.exe
        8⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33722.exe
        7⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        8⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54691.exe
        8⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe
        8⤵
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33041.exe
        7⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54472.exe
        8⤵
        
        PID:18164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1338.exe
        7⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
        7⤵
        
        PID:19100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        6⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3619.exe
        7⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28612.exe
        8⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        9⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        9⤵
        
        PID:16416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        9⤵
        
        PID:18388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64255.exe
        8⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10917.exe
        8⤵
        
        PID:15356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        8⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31479.exe
        7⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49638.exe
        7⤵
        
        PID:17220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        7⤵
        
        PID:18916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
        6⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28228.exe
        7⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41972.exe
        8⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36870.exe
        8⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11501.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25685.exe
        6⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20800.exe
        7⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21178.exe
        7⤵
        
        PID:17224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52983.exe
        6⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15383.exe
        6⤵
        
        PID:15524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29945.exe
        6⤵
        
        PID:19236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17548.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37496.exe
        7⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19956.exe
        8⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64143.exe
        9⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2889.exe
        9⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38703.exe
        9⤵
        
        PID:15808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
        9⤵
        
        PID:18744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18744 -s 472
        10⤵
        Program crash
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6538.exe
        8⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe
        9⤵
        
        PID:15756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        9⤵
        
        PID:18976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
        8⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        8⤵
        
        PID:18668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3598.exe
        7⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57623.exe
        8⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
        8⤵
        
        PID:15580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63695.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:19168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        7⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35371.exe
        7⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52527.exe
        7⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25798.exe
        6⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15872.exe
        7⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61476.exe
        8⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12122.exe
        9⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
        8⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8864 -s 488
        9⤵
        Program crash
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41478.exe
        8⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        8⤵
        
        PID:18312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43915.exe
        7⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39840.exe
        8⤵
        
        PID:18040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        7⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
        7⤵
        
        PID:17980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13441.exe
        6⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57392.exe
        7⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10725.exe
        7⤵
        
        PID:14972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4802.exe
        6⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63472.exe
        7⤵
        
        PID:16188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        7⤵
        
        PID:13648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
        6⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        6⤵
        
        PID:15692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe
        6⤵
        
        PID:18032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19585.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49748.exe
        6⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        7⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64143.exe
        8⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exe
        8⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60126.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63906.exe
        7⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31482.exe
        8⤵
        
        PID:15768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10674.exe
        7⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe
        7⤵
        
        PID:17432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21470.exe
        6⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        7⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7447.exe
        8⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        8⤵
        
        PID:18148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        7⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
        7⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59611.exe
        7⤵
        
        PID:18616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        6⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35828.exe
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6325.exe
        7⤵
        
        PID:17220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62691.exe
        7⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exe
        6⤵
        
        PID:12028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62082.exe
        6⤵
        
        PID:17124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-586.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5435.exe
        5⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15487.exe
        6⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10931.exe
        7⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46876.exe
        8⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5210.exe
        8⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-129.exe
        8⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29314.exe
        7⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41478.exe
        7⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exe
        6⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40037.exe
        7⤵
        
        PID:16208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49978.exe
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
        6⤵
        
        PID:15056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51482.exe
        5⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        6⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13975.exe
        7⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19014.exe
        7⤵
        
        PID:17784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30186.exe
        6⤵
        
        PID:10912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        6⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57015.exe
        5⤵
        
        PID:7184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6039.exe
        6⤵
        
        PID:8508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2539.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23650.exe
        5⤵
        
        PID:17444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27304.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29904.exe
        7⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49120.exe
        8⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36160.exe
        9⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36102.exe
        9⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39838.exe
        8⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49838.exe
        8⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14838.exe
        7⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        8⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9626.exe
        8⤵
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe
        8⤵
        
        PID:18452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        7⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54472.exe
        8⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22839.exe
        7⤵
        
        PID:14248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        7⤵
        
        PID:18548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14122.exe
        6⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57096.exe
        7⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe
        8⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3761.exe
        8⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe
        8⤵
        
        PID:17704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
        7⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49838.exe
        7⤵
        
        PID:14156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44718.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4883.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
        7⤵
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8297.exe
        7⤵
        
        PID:16852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7498.exe
        6⤵
        
        PID:9680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        6⤵
        
        PID:18652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40634.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37880.exe
        6⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7895.exe
        7⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        8⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        8⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21929.exe
        8⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24381.exe
        8⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21285.exe
        7⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44847.exe
        7⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19477.exe
        7⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14994.exe
        6⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        7⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8756 -s 488
        8⤵
        Program crash
        
        PID:18472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        7⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37463.exe
        7⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11006.exe
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        6⤵
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
        6⤵
        
        PID:18328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43582.exe
        6⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        7⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9154.exe
        7⤵
        
        PID:16964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34337.exe
        7⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
        7⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24165.exe
        6⤵
        
        PID:9000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34313.exe
        6⤵
        
        PID:15864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
        6⤵
        
        PID:18760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
        5⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
        6⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        6⤵
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe
        5⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40206.exe
        5⤵
        
        PID:14872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55560.exe
        5⤵
        
        PID:18588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34961.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43780.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18036.exe
        6⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16722.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1131.exe
        8⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        8⤵
        
        PID:13852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55246.exe
        8⤵
        
        PID:19140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37757.exe
        8⤵
        
        PID:18828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51476.exe
        7⤵
        
        PID:19280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4854.exe
        6⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        7⤵
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
        7⤵
        
        PID:408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        6⤵
        
        PID:10580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16782.exe
        6⤵
        
        PID:14660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        6⤵
        
        PID:18496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56499.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2763.exe
        6⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32860.exe
        7⤵
        
        PID:13400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49383.exe
        7⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10725.exe
        6⤵
        
        PID:14812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11998.exe
        6⤵
        
        PID:11936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe
        5⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        6⤵
        
        PID:1228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe
        6⤵
        
        PID:13964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29347.exe
        6⤵
        
        PID:7972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        5⤵
        
        PID:10860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        5⤵
        
        PID:14780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
        5⤵
        
        PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51683.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        5⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        6⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18292.exe
        7⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52719.exe
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28719.exe
        6⤵
        
        PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11006.exe
        5⤵
        
        PID:9916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        5⤵
        
        PID:13348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        5⤵
        
        PID:18864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41778.exe
      4⤵
      PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60708.exe
        5⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe
        6⤵
        
        PID:12120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        6⤵
        
        PID:16296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        6⤵
        
        PID:18800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18598.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59542.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        5⤵
        
        PID:17132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe
      4⤵
      PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47708.exe
      4⤵
      PID:11120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49145.exe
      4⤵
      PID:14944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24610.exe
      4⤵
      PID:18872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43130.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3930.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58772.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13878.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58352.exe
        8⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33888.exe
        9⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24758.exe
        8⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
        8⤵
        
        PID:15872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        7⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36036.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        8⤵
        
        PID:18528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18528 -s 436
        9⤵
        Program crash
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exe
        7⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3518.exe
        7⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
        7⤵
        
        PID:18436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        6⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        7⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
        7⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6641.exe
        7⤵
        
        PID:14704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        7⤵
        
        PID:18060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28869.exe
        6⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        7⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18700 -s 436
        8⤵
        Program crash
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46423.exe
        7⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11494.exe
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9425.exe
        6⤵
        
        PID:15996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
        6⤵
        
        PID:18728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe
        6⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42488.exe
        7⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8775.exe
        8⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe
        8⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe
        8⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6206.exe
        7⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59594.exe
        7⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40779.exe
        7⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4854.exe
        6⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19248.exe
        7⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18422.exe
        7⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2817.exe
        7⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35842.exe
        6⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26539.exe
        6⤵
        
        PID:14172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34905.exe
        6⤵
        
        PID:18296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18296 -s 472
        7⤵
        Program crash
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        6⤵
        
        PID:18232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        5⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56624.exe
        6⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45916.exe
        7⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57498.exe
        7⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25141.exe
        6⤵
        
        PID:12032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        6⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 436
        7⤵
        Program crash
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58663.exe
        5⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61640.exe
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33046.exe
        6⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20938.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55560.exe
        5⤵
        
        PID:18600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52716.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6743.exe
        6⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6995.exe
        8⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        8⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16029.exe
        8⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
        8⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34358.exe
        7⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1597.exe
        7⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61111.exe
        7⤵
        
        PID:19108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53671.exe
        6⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20800.exe
        7⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17094.exe
        7⤵
        
        PID:17260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45126.exe
        6⤵
        
        PID:10708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16782.exe
        6⤵
        
        PID:14668
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14668 -s 452
        7⤵
        Program crash
        
        PID:17300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        6⤵
        
        PID:18568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54844.exe
        6⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        7⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        7⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        7⤵
        
        PID:11876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7462.exe
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57918.exe
        6⤵
        
        PID:14776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30405.exe
        5⤵
        
        PID:8792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40037.exe
        6⤵
        
        PID:15972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        6⤵
        
        PID:17884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30135.exe
        5⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7191.exe
        6⤵
        
        PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61271.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60619.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27356.exe
        5⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46572.exe
        6⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-799.exe
        7⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exe
        7⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44691.exe
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33309.exe
        6⤵
        
        PID:12988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        5⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13191.exe
        6⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16258.exe
        6⤵
        
        PID:14540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        6⤵
        
        PID:18024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        5⤵
        
        PID:10616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16782.exe
        5⤵
        
        PID:14856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43180.exe
        6⤵
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
        5⤵
        
        PID:17988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42738.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
        5⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe
        6⤵
        
        PID:12264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        6⤵
        
        PID:15952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18598.exe
        5⤵
        
        PID:9312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59542.exe
        5⤵
        
        PID:15024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
        5⤵
        
        PID:17404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
      4⤵
      PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33052.exe
        5⤵
        
        PID:13036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12434.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1909.exe
        5⤵
        
        PID:12232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48901.exe
      4⤵
      PID:11836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exe
      4⤵
      PID:6084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39902.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39902.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16261.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1699.exe
        6⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12638.exe
        7⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17956.exe
        8⤵
        
        PID:12256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        8⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        8⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
        7⤵
        
        PID:10796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8422.exe
        7⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        7⤵
        
        PID:18504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21938.exe
        7⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        6⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32424.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15220 -s 232
        8⤵
        Program crash
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58127.exe
        7⤵
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60695.exe
        6⤵
        
        PID:10304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        6⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46882.exe
        5⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15539.exe
        6⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5511.exe
        7⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22184.exe
        8⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        7⤵
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49767.exe
        7⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
        7⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52719.exe
        6⤵
        
        PID:10908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32803.exe
        6⤵
        
        PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38059.exe
        5⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15761.exe
        5⤵
        
        PID:13224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        5⤵
        
        PID:17336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7245.exe
      4⤵
      PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15222.exe
      4⤵
      PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        5⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        5⤵
        
        PID:10428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21929.exe
        5⤵
        
        PID:16012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8013.exe
      4⤵
      PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51011.exe
      4⤵
      PID:12556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48061.exe
      4⤵
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35223.exe
      4⤵
      PID:8244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57163.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11107.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        5⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        6⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45179.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        6⤵
        
        PID:15924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        6⤵
        
        PID:17948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6729.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10674.exe
        5⤵
        
        PID:12588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8946.exe
        5⤵
        
        PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11574.exe
      4⤵
      PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7947.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40203.exe
        6⤵
        
        PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39646.exe
        5⤵
        
        PID:8536
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8536 -s 456
        6⤵
        Program crash
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38250.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        5⤵
        
        PID:16972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22673.exe
      4⤵
      PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        5⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57830.exe
        5⤵
        
        PID:18712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22403.exe
      4⤵
      PID:10564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
      4⤵
      PID:14628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
      4⤵
      PID:18888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22597.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50900.exe
      4⤵
      PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe
        5⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23820.exe
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13326.exe
        6⤵
        
        PID:15060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53746.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41234.exe
        5⤵
        
        PID:10456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16782.exe
        5⤵
        
        PID:14692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        5⤵
        
        PID:18784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33145.exe
      4⤵
      PID:992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1043.exe
        5⤵
        
        PID:11892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-705.exe
        5⤵
        
        PID:532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60695.exe
      4⤵
      PID:10288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe
      4⤵
      PID:15676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
      4⤵
      PID:18736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
    3⤵
    PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4107.exe
      4⤵
      PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4271.exe
        5⤵
        
        PID:12520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        5⤵
        
        PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15054.exe
      4⤵
      PID:10640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10917.exe
      4⤵
      PID:14104
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14104 -s 432
        5⤵
        Program crash
        
        PID:17348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63548.exe
    3⤵
    PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23680.exe
      4⤵
      PID:14632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
      4⤵
      PID:17440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
    3⤵
    PID:10452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61071.exe
    3⤵
    PID:15724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32894.exe
    3⤵
    PID:18676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8190.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8190.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54200.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10967.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20968.exe
        7⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38766.exe
        8⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        9⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-187.exe
        10⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54619.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:17284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        9⤵
        
        PID:12064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33379.exe
        9⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12813.exe
        8⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39822.exe
        8⤵
        
        PID:15176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15176 -s 464
        9⤵
        Program crash
        
        PID:17100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-547.exe
        8⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41890.exe
        7⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50960.exe
        8⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5210.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8297.exe
        8⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40554.exe
        7⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20534.exe
        7⤵
        
        PID:12480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28029.exe
        7⤵
        
        PID:17176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9270.exe
        6⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38766.exe
        7⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe
        8⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        8⤵
        
        PID:16424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56262.exe
        7⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7462.exe
        7⤵
        
        PID:13988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
        7⤵
        
        PID:18276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26845.exe
        6⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25104.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12122.exe
        7⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        7⤵
        
        PID:15036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        7⤵
        
        PID:18044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe
        6⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54904.exe
        7⤵
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        7⤵
        
        PID:16040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        7⤵
        
        PID:18008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-89.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-89.exe
        6⤵
        
        PID:11144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        6⤵
        
        PID:15916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55560.exe
        6⤵
        
        PID:18768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10894.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
        6⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38766.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        8⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        8⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40203.exe
        8⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        8⤵
        
        PID:17388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62866.exe
        7⤵
        
        PID:16896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33722.exe
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45916.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45127.exe
        7⤵
        
        PID:12860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
        7⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32385.exe
        6⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20534.exe
        6⤵
        
        PID:12492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19861.exe
        6⤵
        
        PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59570.exe
        5⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56328.exe
        6⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2327.exe
        7⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        8⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        8⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        8⤵
        
        PID:18184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1406.exe
        7⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21929.exe
        7⤵
        
        PID:16144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1162.exe
        6⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63472.exe
        7⤵
        
        PID:16152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27373.exe
        7⤵
        
        PID:18456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44443.exe
        7⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4809.exe
        6⤵
        
        PID:12624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        6⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        6⤵
        
        PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61491.exe
        5⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32312.exe
        6⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45304.exe
        7⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50151.exe
        7⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8038.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        6⤵
        
        PID:14988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14988 -s 464
        7⤵
        Program crash
        
        PID:12232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29769.exe
        5⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34884.exe
        6⤵
        
        PID:16032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
        6⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5568 -s 476
        7⤵
        Program crash
        
        PID:19164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52983.exe
        5⤵
        
        PID:11544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15383.exe
        5⤵
        
        PID:15500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3354.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48933.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
        6⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26152.exe
        7⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        8⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        8⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53746.exe
        8⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25230.exe
        7⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41478.exe
        7⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        7⤵
        
        PID:12228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3894.exe
        6⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
        7⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
        7⤵
        
        PID:14916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20081.exe
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65407.exe
        6⤵
        
        PID:14900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23369.exe
        6⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27613.exe
        5⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        6⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20800.exe
        7⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-374.exe
        7⤵
        
        PID:17364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        6⤵
        
        PID:10476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        6⤵
        
        PID:15748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        6⤵
        
        PID:18356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12594.exe
        5⤵
        
        PID:7276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2009.exe
        5⤵
        
        PID:12576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1315.exe
        5⤵
        
        PID:17528
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17528 -s 464
        6⤵
        Program crash
        
        PID:10792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37650.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        5⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44875.exe
        6⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe
        6⤵
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        6⤵
        
        PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        5⤵
        
        PID:9068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55791.exe
        5⤵
        
        PID:12728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
        5⤵
        
        PID:17872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39535.exe
      4⤵
      PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe
        6⤵
        
        PID:12152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        6⤵
        
        PID:16052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        6⤵
        
        PID:18808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5578.exe
        5⤵
        
        PID:10032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29993.exe
        5⤵
        
        PID:14528
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14528 -s 472
        6⤵
        Program crash
        
        PID:15648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42844.exe
        5⤵
        
        PID:17284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe
      4⤵
      PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37032.exe
        5⤵
        
        PID:12184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        5⤵
        
        PID:15688
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7468 -s 624
        5⤵
        Program crash
        
        PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50487.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8647.exe
      4⤵
      PID:14580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9909.exe
      4⤵
      PID:17780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47096.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37989.exe
        6⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10883.exe
        9⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        8⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39646.exe
        7⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38250.exe
        7⤵
        
        PID:12968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
        7⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
        7⤵
        
        PID:12116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4942.exe
        6⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30186.exe
        7⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        7⤵
        
        PID:15800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23067.exe
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36181.exe
        6⤵
        
        PID:13360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60311.exe
        6⤵
        
        PID:17172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12970.exe
        5⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
        6⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        7⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        7⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        7⤵
        
        PID:15740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        7⤵
        
        PID:17492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58531.exe
        6⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe
        7⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        7⤵
        
        PID:18896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4809.exe
        6⤵
        
        PID:12512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33649.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65283.exe
        6⤵
        
        PID:11016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2341.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7371.exe
        6⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28968.exe
        7⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-566.exe
        7⤵
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40274.exe
        6⤵
        
        PID:12384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12190.exe
        6⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58671.exe
        5⤵
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28205.exe
        5⤵
        
        PID:12596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15578.exe
        5⤵
        
        PID:17228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60972.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41004.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27740.exe
        6⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
        7⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
        8⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        8⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        8⤵
        
        PID:17972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29610.exe
        7⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6169.exe
        7⤵
        
        PID:15940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55527.exe
        7⤵
        
        PID:18792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62615.exe
        6⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4809.exe
        6⤵
        
        PID:12616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35910.exe
        6⤵
        
        PID:19116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 19116 -s 476
        7⤵
        Program crash
        
        PID:14532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54143.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        6⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30186.exe
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        6⤵
        
        PID:15820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        6⤵
        
        PID:18176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10813.exe
        5⤵
        
        PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10674.exe
        5⤵
        
        PID:12608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52527.exe
        5⤵
        
        PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38958.exe
      4⤵
      PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38766.exe
        5⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58884.exe
        6⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29278.exe
        6⤵
        
        PID:15076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        6⤵
        
        PID:17924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56262.exe
        5⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7462.exe
        5⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55030.exe
        5⤵
        
        PID:15772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
      4⤵
      PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        5⤵
        
        PID:8800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36190.exe
        5⤵
        
        PID:12392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25979.exe
        5⤵
        
        PID:16524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61490.exe
      4⤵
      PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55863.exe
      4⤵
      PID:12904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19239.exe
      4⤵
      PID:1412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40080.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33988.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8087.exe
        6⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1515.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe
        7⤵
        
        PID:15088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18961.exe
        7⤵
        
        PID:11944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46305.exe
        7⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53435.exe
        6⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49838.exe
        6⤵
        
        PID:14212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
        6⤵
        
        PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26898.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50140.exe
        6⤵
        
        PID:9876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36870.exe
        6⤵
        
        PID:14452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        6⤵
        
        PID:18288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
        5⤵
        
        PID:9944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        5⤵
        
        PID:13412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        5⤵
        
        PID:18944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
        5⤵
        
        PID:11772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18014.exe
      4⤵
      PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54356.exe
        5⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        6⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38712.exe
        7⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        6⤵
        
        PID:13652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
        6⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50555.exe
        5⤵
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9661.exe
        5⤵
        
        PID:12896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        5⤵
        
        PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
        5⤵
        
        PID:8096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
      4⤵
      PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe
        5⤵
        
        PID:8360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe
        5⤵
        
        PID:14128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60207.exe
      4⤵
      PID:9864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
      4⤵
      PID:13072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54447.exe
      4⤵
      PID:17716
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17716 -s 444
        5⤵
        Program crash
        
        PID:6192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60235.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37880.exe
      4⤵
      PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7895.exe
        5⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe
        6⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exe
        6⤵
        
        PID:13020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-129.exe
        6⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63218.exe
        6⤵
        
        PID:11440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40798.exe
        5⤵
        
        PID:9736
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9736 -s 452
        6⤵
        Program crash
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
        5⤵
        
        PID:10540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
      4⤵
      PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63192.exe
        5⤵
        
        PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31181.exe
      4⤵
      PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47919.exe
      4⤵
      PID:14620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
      4⤵
      PID:18936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-169.exe
    3⤵
    PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3811.exe
      4⤵
      PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46876.exe
        5⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5210.exe
        5⤵
        
        PID:11364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57498.exe
        5⤵
        
        PID:16884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40798.exe
      4⤵
      PID:9728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16973.exe
      4⤵
      PID:14268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
      4⤵
      PID:10752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30006.exe
    3⤵
    PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59268.exe
      4⤵
      PID:9700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60991.exe
      4⤵
      PID:14728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
      4⤵
      PID:18364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
    3⤵
    PID:9476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50925.exe
    3⤵
    PID:14740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24610.exe
    3⤵
    PID:18984
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12818.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12818.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37880.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3811.exe
        7⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64364.exe
        8⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
        8⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51250.exe
        8⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40798.exe
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16973.exe
        7⤵
        
        PID:14260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47859.exe
        6⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2911.exe
        7⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        7⤵
        
        PID:13520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2817.exe
        7⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27673.exe
        6⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28881.exe
        7⤵
        
        PID:9228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58470.exe
        6⤵
        
        PID:14376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14376 -s 464
        7⤵
        Program crash
        
        PID:12116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
        6⤵
        
        PID:18752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34158.exe
        5⤵
        
        PID:5712
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 720
        6⤵
        Program crash
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24645.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4883.exe
        6⤵
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
        6⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        6⤵
        
        PID:18072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52039.exe
        5⤵
        
        PID:9848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22341.exe
        5⤵
        
        PID:13252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        5⤵
        
        PID:18692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14219.exe
        5⤵
        
        PID:9808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44527.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        6⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        7⤵
        
        PID:14060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        7⤵
        
        PID:18684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
        6⤵
        
        PID:15556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        5⤵
        
        PID:9052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55791.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49638.exe
        5⤵
        
        PID:17204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe
        5⤵
        
        PID:17540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25309.exe
      4⤵
      PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42488.exe
        5⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        6⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
        6⤵
        
        PID:14908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe
        5⤵
        
        PID:11708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14469.exe
        5⤵
        
        PID:16532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        5⤵
        
        PID:18820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe
      4⤵
      PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        5⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37062.exe
        5⤵
        
        PID:14244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
      4⤵
      PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52843.exe
      4⤵
      PID:14816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2040
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 720
      4⤵
      Program crash
      PID:3092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
      4⤵
      PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
        5⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        5⤵
        
        PID:13640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe
        5⤵
        
        PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36278.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65459.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48450.exe
      4⤵
      PID:16944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50443.exe
    3⤵
    PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2114.exe
      4⤵
      PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33192.exe
        5⤵
        
        PID:15096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48179.exe
        5⤵
        
        PID:18660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46423.exe
        5⤵
        
        PID:9516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21197.exe
      4⤵
      PID:11168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51100.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30909.exe
      4⤵
      PID:18320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49998.exe
    3⤵
    PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18100.exe
      4⤵
      PID:6672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30642.exe
    3⤵
    PID:11096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50256.exe
    3⤵
    PID:14836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9909.exe
    3⤵
    PID:17752
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53344.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60308.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38648.exe
        5⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        6⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-799.exe
        7⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe
        7⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44691.exe
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        6⤵
        
        PID:13860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe
        5⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20081.exe
        5⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34313.exe
        5⤵
        
        PID:15840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
        5⤵
        
        PID:17916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
      4⤵
      PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe
        5⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17956.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        6⤵
        
        PID:16432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62979.exe
        6⤵
        
        PID:18524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        6⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe
        5⤵
        
        PID:11716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14469.exe
        5⤵
        
        PID:16516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        5⤵
        
        PID:18836
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18836 -s 448
        6⤵
        Program crash
        
        PID:19184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26757.exe
      4⤵
      PID:7576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54904.exe
        5⤵
        
        PID:12052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        5⤵
        
        PID:16140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        5⤵
        
        PID:18416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34655.exe
      4⤵
      PID:10664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
      4⤵
      PID:14644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
      4⤵
      PID:18476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3494.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
      4⤵
      PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16722.exe
        5⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3363.exe
        6⤵
        
        PID:16380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        6⤵
        
        PID:18484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe
        5⤵
        
        PID:12752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13022.exe
      4⤵
      PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        5⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        5⤵
        
        PID:18016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28789.exe
      4⤵
      PID:10672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16782.exe
      4⤵
      PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
      4⤵
      PID:18844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32325.exe
    3⤵
    PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46572.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
        5⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
        5⤵
        
        PID:14892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        5⤵
        
        PID:18000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
      4⤵
      PID:8696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41478.exe
      4⤵
      PID:12924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
      4⤵
      PID:18348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32623.exe
    3⤵
    PID:7584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
    3⤵
    PID:10744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52843.exe
    3⤵
    PID:14756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47392.exe
    3⤵
    PID:19216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48498.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48498.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60308.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9867.exe
      4⤵
      PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16722.exe
        5⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        6⤵
        
        PID:14492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        6⤵
        
        PID:17908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe
        5⤵
        
        PID:12744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51476.exe
        5⤵
        
        PID:19288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8938.exe
      4⤵
      PID:7628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
        5⤵
        
        PID:10988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        5⤵
        
        PID:16408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        5⤵
        
        PID:17940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22827.exe
        5⤵
        
        PID:9220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
      4⤵
      PID:10608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16782.exe
      4⤵
      PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
      4⤵
      PID:18856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11766.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe
      4⤵
      PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46876.exe
        5⤵
        
        PID:7724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13378.exe
        5⤵
        
        PID:12436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-129.exe
        5⤵
        
        PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25230.exe
      4⤵
      PID:10004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41478.exe
      4⤵
      PID:12572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30841.exe
    3⤵
    PID:7564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54904.exe
      4⤵
      PID:12100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60732.exe
        5⤵
        
        PID:16320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44095.exe
        5⤵
        
        PID:18620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
      4⤵
      PID:15592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
      4⤵
      PID:17900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18318.exe
    3⤵
    PID:10572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8117.exe
    3⤵
    PID:14552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 14552 -s 464
      4⤵
      Program crash
      PID:17384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
    3⤵
    PID:18908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
    3⤵
    PID:6248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
      4⤵
      PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        5⤵
        
        PID:13672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        5⤵
        
        PID:18268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58583.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17653.exe
      4⤵
      PID:15480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21641.exe
      4⤵
      PID:5608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14897.exe
    3⤵
    PID:7676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47136.exe
      4⤵
      PID:16200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
      4⤵
      PID:17832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10674.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13030.exe
    3⤵
    PID:17328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31400.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31400.exe
  2⤵
  PID:1124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16722.exe
    3⤵
    PID:7896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
    3⤵
    PID:12012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3369.exe
    3⤵
    PID:15860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
    3⤵
    PID:19224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38369.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38369.exe
  2⤵
  PID:7460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54904.exe
    3⤵
    PID:12192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
    3⤵
    PID:16392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48854.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48854.exe
  2⤵
  PID:10532
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51518.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51518.exe
  2⤵
  PID:14588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
  2⤵
  PID:18636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 18636 -s 472
    3⤵
    - Program crash
    PID:7072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe
  2⤵
  PID:7236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2040 -ip 2040
1⤵
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5712 -ip 5712
1⤵
PID:7064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 15220 -ip 15220
1⤵
PID:15248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 14528 -ip 14528
1⤵
PID:15684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 15088 -ip 15088
1⤵
PID:16948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 14880 -ip 14880
1⤵
PID:17016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 15356 -ip 15356
1⤵
PID:17240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 14552 -ip 14552
1⤵
PID:17324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 14628 -ip 14628
1⤵
PID:17328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 14376 -ip 14376
1⤵
PID:11964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 14780 -ip 14780
1⤵
PID:8400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 14972 -ip 14972
1⤵
PID:7396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 9068 -ip 9068
1⤵
PID:13968

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 7468 -ip 7468
1⤵
PID:5192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1504 -ip 1504
1⤵
PID:7392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 17528 -ip 17528
1⤵
PID:8920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1048 -p 18176 -ip 18176
1⤵
PID:11800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 18044 -ip 18044
1⤵
PID:17760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 18476 -ip 18476
1⤵
PID:11484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1100 -p 18768 -ip 18768
1⤵
PID:10528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1120 -p 12160 -ip 12160
1⤵
PID:7860

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:6604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1056 -p 9736 -ip 9736
1⤵
PID:8116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 8864 -ip 8864
1⤵
PID:9540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 17780 -ip 17780
1⤵
PID:9380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 18388 -ip 18388
1⤵
PID:9972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 17948 -ip 17948
1⤵
PID:16108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 18416 -ip 18416
1⤵
PID:11188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1100 -p 17404 -ip 17404
1⤵
PID:11776

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:11488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10967.exe

Filesize
184KB

MD5
7df2cc127d03d9b042b7323ce10e2084

SHA1
60e6d2510c562afb2665a40858a90f553964fde5

SHA256
a61ae73996eebed70ade3dea0b5b13f6c2a7631c1ee7f236792bab5fae52c239

SHA512
03473717d85511ef9ea32b195f3f5c95ca8977d3f394aeb022ec2158f421a609b0f33450d8f61a346ba6e637575a1b1119e1188f0b631ad0336c702ab4e280d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe

Filesize
184KB

MD5
42bf9872110ec4e54cc42cb89dac2604

SHA1
aa247e475c7444917f305b48380369d3ae8f4f80

SHA256
74819be2f816c9f4b693942c630586a6e3c9037ebd8dc489e60c9ff940a99375

SHA512
c878d288cc45cf992b60af98236d4c6ace0e96e1039cce1516cd7c4c81f664cba85296cf61764cc79880b2b0860e3536096f8ad0f92655941cb65ed148e0a6ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12818.exe

Filesize
184KB

MD5
250b17404962a35e29c894f1505d1884

SHA1
2a90ec3e110e04cee1c07159375d09138f6761a8

SHA256
94cdf258831ce95bc27f57a0e7954652e8e722c1a5ee11d6c9f07b5c6b21127b

SHA512
79027d0628e2abef5bdeb03fd719e6358de0df6885ec3d9902526632ec5d2f62d7eb49001f8710d9e5cbb870a22cf6f41ee75cffa3f4f1f2ba789548ecd4cf28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe

Filesize
184KB

MD5
80157770f70ce3624b35789b3c48bcf5

SHA1
65cf8a20e326efb89634b2ec80815cdb20ce0e14

SHA256
4c8c5665e6b851b729d121bbd8cbc3995067134b9b7ad0c38d4f537f4fea9b71

SHA512
266e60010ee2f72e1ee93507d6819f20ccd8eb497aebcf8488ea902d95055d2f62e8eb806ac3afaf07f996b68ed37fa62aea4e32fea3441db047061dfb6ad08d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe

Filesize
184KB

MD5
e385abc43a0f89fb8e2bc1951eceb4cd

SHA1
182e5ed93c8182cde37716c614d7eee39a2e4315

SHA256
7e39c57dfdb6f3eef65dc8d5a6fab1375f06bca065651b137df07b4338a82ec0

SHA512
16e02b7a9e194352b163f9e8d12b0ce93d03a794d0a7a21704583a534271e32b1f39ff25fa02925b6aa93d4aac1823d6fc9856793b02df197f7c234f2aa0b580

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe

Filesize
184KB

MD5
876801f95072ce0d57dcef48bdfb4dc7

SHA1
87adaaa962c56483b036844c66948aa592250d30

SHA256
6e0a926e0142bdfa0443e4e9f0672d721e2245ef883d49e520cd0edb502a05c7

SHA512
227100573743990054c2cccb3230c0a61253476299fb7ec42a9e298a88a0596e93109ff51b77987da9ce029356f3d03c2c98da6fc4993afef89b4dcd6569cbf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe

Filesize
184KB

MD5
5c2569cfb2ac905832068c50567a4f10

SHA1
44dc60561e7d86dccb1f2fe05a6f4dd69ca45f9d

SHA256
f0c433b981ae1bb59f1565deec89ffdb83ce3905216f2205e135bed895e346f4

SHA512
045058980ae905d1b851dc6664dad187a08d50f9dc65c741fe9d2958cda96b75b2fb2bdb824cb609963449c56cef5e344abe29e57a3f97d58917c789723afa44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23604.exe

Filesize
184KB

MD5
0a497d457aa87e15cfa2cca0e5206a79

SHA1
6a9adeb1fa0c23873e6a4eb54b89b6ffa5a5951e

SHA256
41326a8ced84b3e000ec549fb9093db2cf758fd98941ce6074b5f24a4f04fa19

SHA512
b5e11fc8b7e739d94ed360afca2105beeb9d8397abfb97be3784778d6179110e2a423ab0e0cffd610432d772f6f02d58ecd0f06c2b5144724ff142a929b7ed9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe

Filesize
184KB

MD5
6afe8a996fe730c541771db6e988f86c

SHA1
4660c76e8747d4f4efbf6d5abb8c4dccaa900e60

SHA256
ecb2d1d1d079afa8a6a0204b9e9bb46cf8e613e392b2f83d874f092f01670996

SHA512
bcc848e9fd5dddfbe74aed535ed4334bafc10e7e5e1aefdea36ff5400061143d610393d732702a73da0c42f0c34fc0d4fdf02db57b8967b3c7ea015f4acebb89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27304.exe

Filesize
184KB

MD5
96484a3ad005147026ad351caee6e318

SHA1
7cf03a5f39f486bbd20a96dccd0cbec74417469f

SHA256
7b744f67de4afb539f702e4784cb319a745d7aba73f98544def07cdefea0e48d

SHA512
f82aadadeaa33deee3ee8e598627ca918461587ffca790b19ada0f029e1f5e381b6977bd9a260aa1636a158fd76db8f6e1f31165d1c0ecef3de091fa8429bc66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe

Filesize
184KB

MD5
101ed0d6b49c50149d04db30c3024d5c

SHA1
7fb0130ce59cbca4dd2f2af09d69631675bbcf6e

SHA256
1a48d4b5c66ce53ba7e55eada09264e2a21384f9729755823bb0649acbe12774

SHA512
59ed9eb9bd6a76f944297fdf112da8162f3295a7500174c6e4a91052ffb981eb09d80617baad31479ba9dd93fce671dcb154c2d1c2d8b623b831022a93b769f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe

Filesize
184KB

MD5
6cada319aa13511dedfa3ee2c5cb6d81

SHA1
eae99e70972d09909eae9e2aa8aacdb1e965a946

SHA256
8bfeb0bba5893461961ed3b363740c3e48e3bf0bc5c475e08ba02c8d1dd7de5f

SHA512
b7fec1007051a144b21a84f6a2d17df2fd47f1a267a4bbe73815160df7e8eeac43d0a9fe8e964f49bab52412c5992faf508c4891ac86ec1492916c440f8d6c46

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3354.exe

Filesize
184KB

MD5
3bded862440c43c88f61eb923ac10a03

SHA1
64a8187a5b53266f01632e06f4fc401603adaf5b

SHA256
8738816d33fd444de6818157ef947feaedd4dc95b1b0c3bde68660579115c729

SHA512
1d0f211fb767895667756e9210adcfbd7f936dff3bf59cf53a4dc9b60ee8db8ff9aec754c1eb227e096456ce257b3e085539fa1fe03812e24ec311d9891ae341

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33780.exe

Filesize
184KB

MD5
97ea618a1872b6eea9f7750f121352de

SHA1
45211702b64b248f0bdb418a70b7053f1ea9d2ec

SHA256
e3c054a065bb14925ae417d8c61197e64eb599b0958e19f121e174ce55591c26

SHA512
5a25be4a87be1fd92127f6e2cda223b5048b92f3370813a04b7182bb4f622540d320b0d81b064059a6b0ed91490e097a4545aaff1796235890dad601f3dd96d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34961.exe

Filesize
184KB

MD5
17bd709115bd09fdc927e51c698b5a6b

SHA1
6fe9e5c52e77255fd28ff97cd3e756725a55d969

SHA256
2e8c4fed3429ac951064d8c7e683f39e857801bd656505e5e2efb9b031b29ab8

SHA512
de2c6d619cac6c236f857379d65feb1625a14e3f8122e93a0f2c46849aed24c377a06b87fd2f697d79a9176cd783b5d1def9148aab37fc7e2aa2921716846e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3930.exe

Filesize
184KB

MD5
57671cfdb43f2777f4cc62d3ea803cf3

SHA1
2b298fb3b687d38d583ff993e90d470efbd84c47

SHA256
e6f9b95f0e55ba7693dbdac461809cf1641be8c99fb935fe4bc036c7e4e61575

SHA512
ba9ad46c3105308e73b11f391e81ddd4cb469ff51cac8dc379b4b45d9b800974a111581425fc859b9440c14b0dbe4cd6a8b20f674bc348699848f44f88fba89e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39902.exe

Filesize
184KB

MD5
6da22c139c3a8320bf4a46757eb92430

SHA1
465cce94b7b9d50d96a61233052d32a4cb11369c

SHA256
8b79503bf78c9edcbe51d3cd4ed88ef1511e227e2bc273c1bda0e538d7892b3c

SHA512
423cd7c8e3bb4862d096f4b583819408f9e3495c8fb9c4818df1a0d36260362367d84c36ceee71cc5451be932b09c164abe7ecb86d13550563d68bb5fdc26017

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40274.exe

Filesize
184KB

MD5
86bb967df5e3fe3cc0c6c5873a241fad

SHA1
2eb6d95bb3281c9b9f0662eebc20f86bd4d5cb27

SHA256
454967f8630e6e1656821c765879c2e25f39414cb63d07320e896b9e210ddbe2

SHA512
fb52cf66c71ab75240fb0f51e1d3f494e8611a1816f252ecc91175dfb7012aa567d8bcf45d59f52d27e978ea79a4afb1c6e424d2deadf12d1b31bece1a37bbd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe

Filesize
184KB

MD5
9055815a805d71a3beb6c159be86e6a1

SHA1
4dea5e0993688968264a2f3a666912c8636361ca

SHA256
23a06d019812f280985184d3a35f53ca3572b951212e306f6b299eac0b623942

SHA512
f15116fad88bce20ea0ee5ababdf3ee9e19ef2612219c703bebf82d73b7aa341cdd4d4c10086e11d44c74bb5231f94db676db42fb88493581be752d571670ad9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe

Filesize
184KB

MD5
d2c73ce6d86b468cff2670aec03002a0

SHA1
3785c2d4698d10875e26c60f58ad3cb44cb94f7d

SHA256
5acd8c3090f5b87825c741624592e5b717ab1919aaec07aeb63d445a21b1320a

SHA512
5b9c527634e9ddd101be2a24cf289df45e0340f5d6a76277b53f283486661772d0f54a721b55e212b400b8ea30ed336cc02efaaa09ea4d7749f052096685947c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43130.exe

Filesize
184KB

MD5
b7b8bcdaa3a14566d6c886faa981c2df

SHA1
d5b4ff51230dbc86ffda58ebcf2cd8c5cc47fca6

SHA256
9a11628a4bb6b091d2133879db22f7b82231ca75d7fb0ce40f00060965beee8e

SHA512
121add72b93c430ee95cf3c45b350f567b9621f4f7b9f1da692185d48e63c4e3dcd8f3eb39d4410dac4cfb49ca65f5094794d3e6436f0611e335844220ff0cab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe

Filesize
184KB

MD5
4ec25ca0e4b5e2a60fd360d75a573335

SHA1
15a81c3d1cc6677f4f9aae90d65882c3b7952e19

SHA256
1293c6c82352f18f2d6ed5fb5c9967534be8c3bf0003f9c4ed3457473926deda

SHA512
0e82aed70b235b28a90eb104e319ffe78a2dacfac44eebf5b050e771b04947fac39468896b204d20d0886b2a40184b0b08444ead131ea52bd1ceaa9c842e4ebf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48498.exe

Filesize
184KB

MD5
fd27b3f483d0d75de0f995f059da8a08

SHA1
d37703dc6c1c1a87850d0538cc4c22cca5b5e1a4

SHA256
9511e7fa3738e994e2a87806743d5cebc39c93fb26cb4f0ddd2de2148eec9038

SHA512
45ef312c0d639e229b8b15d690b4ca9eb126b2f25d48409b2703efb6d9407131a9d6d8be508d49afd8fdc9705bfdeac28b413fddf9196ba81580155db9138b43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50967.exe

Filesize
184KB

MD5
128cec33d9f99262f9c8e0cb70529350

SHA1
9b9673f75996199faac40a9796b4c8aa7d0983d8

SHA256
0e9129f19c118f49f1bcdd231fe0630eb1f8952bb1673a3a64cf224af535ef2f

SHA512
6da3a829e46e48ebd61504b2c4180f3240036e06eba1aef5fd1b9b04023048edc09c8f34a04972363eb17e7d7a79744a91edc512a3fe4ea52dd13261b5e8b13c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53070.exe

Filesize
184KB

MD5
aa43ff8b718444d7339d47fc4941b772

SHA1
050c4f82de0430480eee1fcc410b27de265704eb

SHA256
b7aa54f56c57130d3e8107a0c7eb7632690139916135945e440ab7b9586c0803

SHA512
416b47e8cf907874edc1879722b536dd190a56901ccbc390028310e8d8732de973fec67f55ba6ca2be2dc2dcb27f1d96a889e803610d95cbeb4c280da2ec1b3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53344.exe

Filesize
184KB

MD5
7bed77c01bab4f31178c6b57f8e6c10f

SHA1
bba810ca4ac7f86f94f63451426eb623b2657296

SHA256
6c23599c97fcec88192816df678f0edd5f6a00223f727700b8f444611910cd9f

SHA512
4e1153b4442fbcca7e89863ed5324d361d09404a815f011cf8df2f59fc719ec558ca473b9b9b9bbed8033fcd6cef155741fdf09bc131a4efcffb2313b5ec0cf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54200.exe

Filesize
184KB

MD5
01739bf0dafb15312b3b91c691f2830e

SHA1
25e24191ddc3ad9359ddeaaf026b51becb5c3c39

SHA256
6f47dedcaf5f629c8a18021530ada668f65e35d9c1cc14e419491226ee60abeb

SHA512
591b1c62656710380c7b6bf8b792bb133cf63637564b41f0f889ac029419fab1d4c5eadd9addcc3958a0336e18e7fa97b9846be98732fdb0adb06a20675773f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54532.exe

Filesize
184KB

MD5
cb93fd363876da2bcf8c4b96f06035b6

SHA1
85f8a2a7b52fd5d45b136f4faf222590538f0292

SHA256
fe39e31bfcdde360327dc7168cecf4b965b116e3ad302e4ddcb4dd1a53ca51d2

SHA512
f712a794bd8f628280606f7d05693fb2022a659943bdb25d9e043b1437bc9aba68d40eb6ed378320b65af71d4c2b5d45fb6094febcfc83a980981348fd103402

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57163.exe

Filesize
184KB

MD5
1ab0a6e1f509fb3c0e26044a0fbe3033

SHA1
f44ad707a801c1de656ff966c99d1a78b59ebced

SHA256
5be29dc8d3e41959ada67ab529a3b80bea343ce3de9e1b3d78c75332d58dbb22

SHA512
4375bda54a03e018778188c827e8fac1d884bc6e43663be187c8b59eacbbd04355ef7c2337cef32e6c4403cfebec03195a0829326af4fc96426a7821e6d4316d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58772.exe

Filesize
184KB

MD5
232306780b5bce0cfd939fbb2370af24

SHA1
30fcaeb4d2a74612e96713ff6c57e1bf0ccc2a2f

SHA256
bffd504a8c20420bf0c782f17a19fcbd00a1bcc177f6b4d51a440d616cf121ab

SHA512
e472e09f8672fd5722179d082324985ad587846e33efc2c12429550116ef97828e042346b11d56fea0081d6628c8ddfe33373eca4f4676fea74a3c74460cff0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe

Filesize
184KB

MD5
caac47b3645b539a6b53a37113e6950f

SHA1
7875dd77b4ebe3602b95835efd3d0a55b8a378a8

SHA256
f0ea984d607d6dc549d718fceb0c6d937dc9e4b5635bc983080b87b7cd5ce1b4

SHA512
3c69bfdcd4b7898b17881b20b4a88704ad94b8058863185c074c1a7906b5660efbc5c05ddea78503953c330da532c929817daf7483b65a73fe820abd8e3e13d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe

Filesize
184KB

MD5
b3d64b54e25ee3a3fb8bad968632bf92

SHA1
a3e947d9bf514a39791b433c23bf78298bbf9b05

SHA256
f0a7124fad04ad9724d2421acc4f38f79b422ff34a97c2a67b5fc6d392389b11

SHA512
0fa9e019ac3461ee66fbc9aadcaf031dd6efb48ef726e761b8f11cc9015aaac0e68fdd81eef21f03bc5a66d5651d86de7c5fb7e8103a9d39f7f6f859d04a5920

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62996.exe

Filesize
184KB

MD5
c9c7e9676d705a1a11756fc9f280a82c

SHA1
e0b42cd4078ac01e4af7795ab3e409abdf6f747f

SHA256
2976ae2192e08a618c884cc9beab3060292f62acfeb4929afa4ec11f399e5bc5

SHA512
9f539087e73daf2b23fe0050cf010c86a26836735d0db9fba72596c071081e30ea08e2e0f78cc3f549fce0c9fe0a29b30b8e1d2fbea0ec8824f0916c04278998

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6995.exe

Filesize
184KB

MD5
f7d2c9e38077bb430926fb6d15247ce7

SHA1
f4466fe120e02881bff5faf9c2cfe617ec4f7edf

SHA256
e961880aac333f663d04674dc7890a2e8c84df81c0e94db72d1a29e8680842ae

SHA512
456abfb7fdb4824e7a6c8be18fce6addbb8e91355d537315cc464b3a43ad308e00c6d4a60f4ff20841f6cc211017fdbcbdf900b3d94b1be73db1828d4d2755d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8190.exe

Filesize
184KB

MD5
927535949dadbe4b7fe6b3f44e75b9fe

SHA1
a6f91f2e2521c2b76b1af7f682addda37f62701f

SHA256
9448c30abec71de8025096c7a2591f43f1ae743bb9c3d8c216abdbe4cceb67e8

SHA512
1bb3e979453a77512b5194c852bb5a2f0790d9af5c00c05c15426f61167e2ec41a66e7dd7e304355bae929df4d00b8acbfcd4b30e8723731ed9ab3057bba2af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe

Filesize
184KB

MD5
fd45c94dc2bc5aa666f79f23e5387b88

SHA1
e45898f7a5b7443bd2a82c3135a6f146fca47c15

SHA256
a891fb932a1bb32de55e5c109a68bedc24f972baa4c4e5b93fd4c3ed6e9541b8

SHA512
09628c0277a1ba81d3377b42473b640c0bc7cceb33a8fc6d38d1a6842d6aaee23ef4c418c1fda6cbac6e12aae48f3c2ae27651e9c4bf687b8d78b972a428edbe

Download Submit
memory/864-192-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/916-19-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/916-509-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/924-385-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/956-303-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/972-285-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1040-94-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1320-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1320-444-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1360-343-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1372-393-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1416-171-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1424-245-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1492-127-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1556-317-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1736-71-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1776-315-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1848-279-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1852-113-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1960-318-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1968-106-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1988-250-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1992-416-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2028-417-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2040-363-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2040-189-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2064-30-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2128-342-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2164-188-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2220-193-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2288-227-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2340-170-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2384-5190-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2392-98-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2784-236-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2868-6-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2868-476-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2912-47-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2940-376-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2980-141-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3052-338-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3088-100-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3092-396-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3196-320-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3200-33-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3204-136-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3364-121-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3396-358-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3424-260-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3476-158-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3500-240-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3508-395-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3568-157-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3616-228-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3688-314-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3868-361-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3916-304-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4064-169-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4128-46-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4184-265-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4296-75-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4320-321-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4356-211-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4436-404-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4456-255-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4508-392-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4544-502-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4544-16-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4604-72-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4612-280-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4632-57-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4636-394-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4692-359-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4700-268-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4828-216-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5008-362-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5100-305-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5184-427-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5216-428-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5252-439-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5276-441-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5296-442-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5312-443-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5404-461-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5424-463-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5432-462-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5472-473-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5512-475-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5520-474-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5592-483-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5596-481-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5712-491-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5744-4273-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5780-507-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5800-511-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5820-523-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5856-525-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5924-539-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6688-3835-0x0000000076A30000-0x0000000076AAB000-memory.dmp

Filesize
492KB

Download
memory/6772-4950-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/7692-4606-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/14340-3895-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/14704-3163-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/14880-3091-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/14900-3061-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15024-3054-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads