ccae55c5dcccf705f27e21086dc9ecb47f3cca4632383681354ce51bbe1c6bc7

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 07:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78958542d29ddb1de2c5c2b58d9fe730N.exe
Size

468KB
MD5

78958542d29ddb1de2c5c2b58d9fe730
SHA1

14708cdb15c1b5f64dfa8025a9ef1d26d2a76137
SHA256

ccae55c5dcccf705f27e21086dc9ecb47f3cca4632383681354ce51bbe1c6bc7
SHA512

2226e9970da32ca74ec79c58cb6172ee7b5f43269e136edebd7820909f7b262fa88c201bc39d08374ffd674cf58222f017f2a24ad8522c69c39f48dbdcd4697e
SSDEEP

3072:lqktog7xj88U2bY9PzsyJfU/Ekhjj+pKPmHXLVIpdQLGUcJNZOlB:lqmoQRU2+PoyJf0uJydQytJNZ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1664	Unicorn-31836.exe
3096	Unicorn-24348.exe
3480	Unicorn-4482.exe
732	Unicorn-32319.exe
4464	Unicorn-11580.exe
1464	Unicorn-17711.exe
4428	Unicorn-63382.exe
3564	Unicorn-26668.exe
1628	Unicorn-10066.exe
4928	Unicorn-50103.exe
1792	Unicorn-59340.exe
4136	Unicorn-28897.exe
4848	Unicorn-15162.exe
3568	Unicorn-25337.exe
2568	Unicorn-30783.exe
4968	Unicorn-9786.exe
944	Unicorn-20607.exe
1928	Unicorn-20607.exe
2236	Unicorn-45303.exe
3360	Unicorn-45303.exe
2692	Unicorn-14668.exe
3844	Unicorn-11593.exe
1328	Unicorn-20258.exe
3116	Unicorn-658.exe
864	Unicorn-658.exe
224	Unicorn-23980.exe
4668	Unicorn-56387.exe
220	Unicorn-34260.exe
2516	Unicorn-29661.exe
3728	Unicorn-49719.exe
404	Unicorn-19084.exe
1956	Unicorn-5541.exe
4372	Unicorn-57996.exe
4344	Unicorn-4389.exe
4792	Unicorn-65479.exe
1560	Unicorn-15147.exe
4636	Unicorn-3642.exe
4924	Unicorn-61011.exe
440	Unicorn-14270.exe
684	Unicorn-14270.exe
876	Unicorn-55422.exe
1184	Unicorn-49557.exe
2444	Unicorn-37815.exe
4092	Unicorn-47052.exe
4320	Unicorn-13310.exe
1592	Unicorn-13310.exe
1948	Unicorn-54842.exe
1556	Unicorn-57642.exe
2660	Unicorn-43907.exe
1432	Unicorn-38306.exe
3916	Unicorn-41655.exe
1360	Unicorn-22858.exe
2448	Unicorn-42724.exe
3644	Unicorn-17649.exe
2436	Unicorn-57607.exe
2372	Unicorn-16575.exe
1088	Unicorn-41271.exe
2032	Unicorn-57991.exe
3908	Unicorn-57991.exe
4796	Unicorn-36402.exe
1624	Unicorn-16693.exe
4616	Unicorn-39853.exe
3968	Unicorn-8442.exe
5048	Unicorn-28308.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
3908	4428	WerFault.exe	98
10004	6428	WerFault.exe	285
10172	5424	WerFault.exe	192
8584	6280	WerFault.exe	286
13548	14156	WerFault.exe	680

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11987.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51342.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15396	dwm.exe
Token: SeChangeNotifyPrivilege	15396	dwm.exe
Token: 33	15396	dwm.exe
Token: SeIncBasePriorityPrivilege	15396	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3496	78958542d29ddb1de2c5c2b58d9fe730N.exe
1664	Unicorn-31836.exe
3096	Unicorn-24348.exe
3480	Unicorn-4482.exe
4464	Unicorn-11580.exe
4428	Unicorn-63382.exe
1464	Unicorn-17711.exe
732	Unicorn-32319.exe
3564	Unicorn-26668.exe
1628	Unicorn-10066.exe
1792	Unicorn-59340.exe
4928	Unicorn-50103.exe
4136	Unicorn-28897.exe
4848	Unicorn-15162.exe
3568	Unicorn-25337.exe
2568	Unicorn-30783.exe
4968	Unicorn-9786.exe
944	Unicorn-20607.exe
1928	Unicorn-20607.exe
2236	Unicorn-45303.exe
1328	Unicorn-20258.exe
2692	Unicorn-14668.exe
3844	Unicorn-11593.exe
864	Unicorn-658.exe
3360	Unicorn-45303.exe
3116	Unicorn-658.exe
224	Unicorn-23980.exe
4668	Unicorn-56387.exe
220	Unicorn-34260.exe
2516	Unicorn-29661.exe
3728	Unicorn-49719.exe
404	Unicorn-19084.exe
1956	Unicorn-5541.exe
4372	Unicorn-57996.exe
4344	Unicorn-4389.exe
4792	Unicorn-65479.exe
1560	Unicorn-15147.exe
4636	Unicorn-3642.exe
684	Unicorn-14270.exe
4924	Unicorn-61011.exe
440	Unicorn-14270.exe
1184	Unicorn-49557.exe
876	Unicorn-55422.exe
2444	Unicorn-37815.exe
1948	Unicorn-54842.exe
4320	Unicorn-13310.exe
1432	Unicorn-38306.exe
4092	Unicorn-47052.exe
1592	Unicorn-13310.exe
1556	Unicorn-57642.exe
2660	Unicorn-43907.exe
3916	Unicorn-41655.exe
1360	Unicorn-22858.exe
3644	Unicorn-17649.exe
2448	Unicorn-42724.exe
2436	Unicorn-57607.exe
2372	Unicorn-16575.exe
1088	Unicorn-41271.exe
2032	Unicorn-57991.exe
3908	Unicorn-57991.exe
4616	Unicorn-39853.exe
1624	Unicorn-16693.exe
4796	Unicorn-36402.exe
2496	Unicorn-43575.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 1664	3496	78958542d29ddb1de2c5c2b58d9fe730N.exe	89
PID 3496 wrote to memory of 1664	3496	78958542d29ddb1de2c5c2b58d9fe730N.exe	89
PID 3496 wrote to memory of 1664	3496	78958542d29ddb1de2c5c2b58d9fe730N.exe	89
PID 1664 wrote to memory of 3096	1664	Unicorn-31836.exe	92
PID 1664 wrote to memory of 3096	1664	Unicorn-31836.exe	92
PID 1664 wrote to memory of 3096	1664	Unicorn-31836.exe	92
PID 3496 wrote to memory of 3480	3496	78958542d29ddb1de2c5c2b58d9fe730N.exe	93
PID 3496 wrote to memory of 3480	3496	78958542d29ddb1de2c5c2b58d9fe730N.exe	93
PID 3496 wrote to memory of 3480	3496	78958542d29ddb1de2c5c2b58d9fe730N.exe	93
PID 3096 wrote to memory of 732	3096	Unicorn-24348.exe	95
PID 3096 wrote to memory of 732	3096	Unicorn-24348.exe	95
PID 3096 wrote to memory of 732	3096	Unicorn-24348.exe	95
PID 3480 wrote to memory of 1464	3480	Unicorn-4482.exe	97
PID 3480 wrote to memory of 1464	3480	Unicorn-4482.exe	97
PID 3480 wrote to memory of 1464	3480	Unicorn-4482.exe	97
PID 3496 wrote to memory of 4464	3496	78958542d29ddb1de2c5c2b58d9fe730N.exe	96
PID 3496 wrote to memory of 4464	3496	78958542d29ddb1de2c5c2b58d9fe730N.exe	96
PID 3496 wrote to memory of 4464	3496	78958542d29ddb1de2c5c2b58d9fe730N.exe	96
PID 1664 wrote to memory of 4428	1664	Unicorn-31836.exe	98
PID 1664 wrote to memory of 4428	1664	Unicorn-31836.exe	98
PID 1664 wrote to memory of 4428	1664	Unicorn-31836.exe	98
PID 4464 wrote to memory of 3564	4464	Unicorn-11580.exe	101
PID 4464 wrote to memory of 3564	4464	Unicorn-11580.exe	101
PID 4464 wrote to memory of 3564	4464	Unicorn-11580.exe	101
PID 3496 wrote to memory of 1628	3496	78958542d29ddb1de2c5c2b58d9fe730N.exe	102
PID 3496 wrote to memory of 1628	3496	78958542d29ddb1de2c5c2b58d9fe730N.exe	102
PID 3496 wrote to memory of 1628	3496	78958542d29ddb1de2c5c2b58d9fe730N.exe	102
PID 1464 wrote to memory of 4928	1464	Unicorn-17711.exe	103
PID 1464 wrote to memory of 4928	1464	Unicorn-17711.exe	103
PID 1464 wrote to memory of 4928	1464	Unicorn-17711.exe	103
PID 732 wrote to memory of 1792	732	Unicorn-32319.exe	105
PID 732 wrote to memory of 1792	732	Unicorn-32319.exe	105
PID 732 wrote to memory of 1792	732	Unicorn-32319.exe	105
PID 1664 wrote to memory of 4136	1664	Unicorn-31836.exe	106
PID 1664 wrote to memory of 4136	1664	Unicorn-31836.exe	106
PID 1664 wrote to memory of 4136	1664	Unicorn-31836.exe	106
PID 3096 wrote to memory of 4848	3096	Unicorn-24348.exe	107
PID 3096 wrote to memory of 4848	3096	Unicorn-24348.exe	107
PID 3096 wrote to memory of 4848	3096	Unicorn-24348.exe	107
PID 3480 wrote to memory of 3568	3480	Unicorn-4482.exe	110
PID 3480 wrote to memory of 3568	3480	Unicorn-4482.exe	110
PID 3480 wrote to memory of 3568	3480	Unicorn-4482.exe	110
PID 3564 wrote to memory of 2568	3564	Unicorn-26668.exe	111
PID 3564 wrote to memory of 2568	3564	Unicorn-26668.exe	111
PID 3564 wrote to memory of 2568	3564	Unicorn-26668.exe	111
PID 4464 wrote to memory of 4968	4464	Unicorn-11580.exe	112
PID 4464 wrote to memory of 4968	4464	Unicorn-11580.exe	112
PID 4464 wrote to memory of 4968	4464	Unicorn-11580.exe	112
PID 4928 wrote to memory of 944	4928	Unicorn-50103.exe	113
PID 4928 wrote to memory of 944	4928	Unicorn-50103.exe	113
PID 4928 wrote to memory of 944	4928	Unicorn-50103.exe	113
PID 4136 wrote to memory of 1928	4136	Unicorn-28897.exe	114
PID 4136 wrote to memory of 1928	4136	Unicorn-28897.exe	114
PID 4136 wrote to memory of 1928	4136	Unicorn-28897.exe	114
PID 1792 wrote to memory of 2236	1792	Unicorn-59340.exe	115
PID 1792 wrote to memory of 2236	1792	Unicorn-59340.exe	115
PID 1792 wrote to memory of 2236	1792	Unicorn-59340.exe	115
PID 1628 wrote to memory of 3360	1628	Unicorn-10066.exe	116
PID 1628 wrote to memory of 3360	1628	Unicorn-10066.exe	116
PID 1628 wrote to memory of 3360	1628	Unicorn-10066.exe	116
PID 3096 wrote to memory of 2692	3096	Unicorn-24348.exe	117
PID 3096 wrote to memory of 2692	3096	Unicorn-24348.exe	117
PID 3096 wrote to memory of 2692	3096	Unicorn-24348.exe	117
PID 3496 wrote to memory of 3844	3496	78958542d29ddb1de2c5c2b58d9fe730N.exe	118

C:\Users\Admin\AppData\Local\Temp\78958542d29ddb1de2c5c2b58d9fe730N.exe
"C:\Users\Admin\AppData\Local\Temp\78958542d29ddb1de2c5c2b58d9fe730N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24348.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32319.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45303.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15147.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19071.exe
        8⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11987.exe
        9⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10947.exe
        10⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28660.exe
        11⤵
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
        11⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37522.exe
        10⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42654.exe
        10⤵
        
        PID:17496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8653.exe
        9⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        9⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        8⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29479.exe
        9⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        9⤵
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58781.exe
        9⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62971.exe
        8⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33676.exe
        8⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        7⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11795.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12846.exe
        9⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64196.exe
        10⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
        10⤵
        
        PID:15108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
        9⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe
        8⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6405.exe
        9⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42882.exe
        8⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        8⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37853.exe
        7⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        8⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
        8⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42846.exe
        8⤵
        
        PID:17936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17309.exe
        7⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2329.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        7⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61011.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7934.exe
        7⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        8⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59956.exe
        9⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29236.exe
        10⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        10⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
        9⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50997.exe
        9⤵
        
        PID:17516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23365.exe
        8⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        8⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51410.exe
        7⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
        7⤵
        
        PID:14156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14156 -s 68
        8⤵
        Program crash
        
        PID:13548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
        7⤵
        
        PID:15736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26801.exe
        6⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13331.exe
        7⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16791.exe
        8⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17516.exe
        8⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15829.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        7⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42530.exe
        7⤵
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        7⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17887.exe
        8⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
        8⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17453.exe
        7⤵
        
        PID:15060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19692.exe
        6⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17870.exe
        6⤵
        
        PID:728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-658.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14270.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        7⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26871.exe
        8⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50838.exe
        9⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26812.exe
        10⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47886.exe
        10⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42846.exe
        10⤵
        
        PID:228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57277.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        9⤵
        
        PID:14628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36125.exe
        8⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        9⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
        9⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        8⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe
        8⤵
        
        PID:16300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9212.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51524.exe
        8⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45867.exe
        7⤵
        
        PID:10896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-421.exe
        7⤵
        
        PID:14988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39770.exe
        6⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50812.exe
        7⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28732.exe
        8⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15227.exe
        9⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57590.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34678.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25306.exe
        7⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10036.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        7⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57558.exe
        6⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
        7⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1501.exe
        7⤵
        
        PID:15016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55754.exe
        6⤵
        
        PID:11356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        6⤵
        
        PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49557.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18495.exe
        6⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11987.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50911.exe
        8⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10470.exe
        9⤵
        
        PID:12100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31786.exe
        10⤵
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
        9⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28285.exe
        8⤵
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35538.exe
        8⤵
        
        PID:16904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8653.exe
        7⤵
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        7⤵
        
        PID:14692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3822.exe
        7⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58102.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe
        6⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27871.exe
        7⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63021.exe
        7⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51171.exe
        6⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        6⤵
        
        PID:14644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41904.exe
        5⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        7⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe
        7⤵
        
        PID:14976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22492.exe
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41934.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42530.exe
        6⤵
        
        PID:1408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        5⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2954.exe
        6⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46986.exe
        5⤵
        
        PID:10600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61877.exe
        5⤵
        
        PID:14816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15162.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
        7⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46012.exe
        8⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
        9⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43652.exe
        10⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        10⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28285.exe
        9⤵
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6453.exe
        8⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61475.exe
        9⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
        8⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3645.exe
        7⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        8⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
        9⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        8⤵
        
        PID:13008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58781.exe
        8⤵
        
        PID:17424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22492.exe
        7⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        7⤵
        
        PID:14716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43546.exe
        7⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
        8⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36285.exe
        8⤵
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        7⤵
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        7⤵
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18637.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        7⤵
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe
        6⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        6⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37445.exe
        5⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
        6⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21015.exe
        7⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47476.exe
        8⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22549.exe
        8⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57678.exe
        7⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        7⤵
        
        PID:14768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3563.exe
        7⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe
        7⤵
        
        PID:17860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40875.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56173.exe
        6⤵
        
        PID:17488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
        5⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46806.exe
        6⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47246.exe
        7⤵
        
        PID:1164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe
        6⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe
        5⤵
        
        PID:9012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24413.exe
        5⤵
        
        PID:11868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56511.exe
        5⤵
        
        PID:17444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14668.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14270.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49351.exe
        6⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7780.exe
        7⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59012.exe
        8⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe
        8⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15965.exe
        7⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10812.exe
        7⤵
        
        PID:16420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38716.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64871.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7780.exe
        6⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38501.exe
        7⤵
        
        PID:14484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46630.exe
        6⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64341.exe
        6⤵
        
        PID:17276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63147.exe
        5⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
        6⤵
        
        PID:16320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
        5⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29725.exe
        5⤵
        
        PID:15264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55422.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8619.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29860.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1710.exe
        7⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        8⤵
        
        PID:16884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3781.exe
        7⤵
        
        PID:12844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        6⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60515.exe
        7⤵
        
        PID:15832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42530.exe
        6⤵
        
        PID:14348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64573.exe
        5⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13158.exe
        6⤵
        
        PID:11420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35818.exe
        6⤵
        
        PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40662.exe
        5⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5913.exe
        5⤵
        
        PID:15820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57250.exe
      4⤵
      PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        5⤵
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
        6⤵
        
        PID:12628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10018.exe
        5⤵
        
        PID:10576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        5⤵
        
        PID:13848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15149.exe
      4⤵
      PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
        5⤵
        
        PID:10200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
      4⤵
      PID:10376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28436.exe
      4⤵
      PID:4752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63382.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4428
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 720
      4⤵
      Program crash
      PID:3908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20607.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65479.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43575.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36684.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        9⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44243.exe
        8⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33980.exe
        8⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        7⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
        8⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        7⤵
        
        PID:14620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-189.exe
        6⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        7⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        7⤵
        
        PID:12968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        6⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        6⤵
        
        PID:14516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        6⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        7⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54326.exe
        7⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34678.exe
        7⤵
        
        PID:16820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39893.exe
        6⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        6⤵
        
        PID:14492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32564.exe
        5⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        6⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        6⤵
        
        PID:14568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28358.exe
        5⤵
        
        PID:9876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33268.exe
        5⤵
        
        PID:13812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
        5⤵
        
        PID:14404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18495.exe
        5⤵
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43015.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        8⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37605.exe
        8⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25237.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34330.exe
        7⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        7⤵
        
        PID:15124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5674.exe
        6⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59811.exe
        7⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
        7⤵
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49515.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3308.exe
        6⤵
        
        PID:14936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53331.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59956.exe
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
        6⤵
        
        PID:12240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45179.exe
        6⤵
        
        PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        5⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35325.exe
        6⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16949.exe
        5⤵
        
        PID:14820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52458.exe
      4⤵
      PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29860.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16791.exe
        6⤵
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27329.exe
        6⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26012.exe
        6⤵
        
        PID:18396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        5⤵
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42530.exe
        5⤵
        
        PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19789.exe
      4⤵
      PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        5⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37605.exe
        5⤵
        
        PID:14144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        5⤵
        
        PID:14888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19692.exe
      4⤵
      PID:9932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25621.exe
        5⤵
        
        PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49967.exe
      4⤵
      PID:4292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20258.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47052.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57820.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29860.exe
        6⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26023.exe
        7⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52012.exe
        8⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22865.exe
        8⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3781.exe
        7⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        7⤵
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64014.exe
        6⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18965.exe
        6⤵
        
        PID:13904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55981.exe
        6⤵
        
        PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        5⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10542.exe
        6⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51382.exe
        7⤵
        
        PID:16648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41258.exe
        6⤵
        
        PID:12424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
        6⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62269.exe
        5⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe
        5⤵
        
        PID:11508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31180.exe
        5⤵
        
        PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54483.exe
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11310.exe
        5⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29479.exe
        6⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8620.exe
        6⤵
        
        PID:16076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34330.exe
        5⤵
        
        PID:10108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        6⤵
        
        PID:16428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        5⤵
        
        PID:14324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34484.exe
      4⤵
      PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        5⤵
        
        PID:10156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33981.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44907.exe
      4⤵
      PID:11028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16202.exe
      4⤵
      PID:3924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54842.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
      4⤵
      PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25570.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
        6⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22492.exe
        5⤵
        
        PID:9880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        5⤵
        
        PID:14872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
      4⤵
      PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4974.exe
        5⤵
        
        PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
        5⤵
        
        PID:12632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58781.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
      4⤵
      PID:10280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2162.exe
      4⤵
      PID:13148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe
      4⤵
      PID:2820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
    3⤵
    PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55358.exe
      4⤵
      PID:6428
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6428 -s 640
        5⤵
        Program crash
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        5⤵
        
        PID:12508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45238.exe
        5⤵
        
        PID:5540
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 624
      4⤵
      Program crash
      PID:10172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29914.exe
      4⤵
      PID:10584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5252.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32215.exe
    3⤵
    PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
      4⤵
      PID:12052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38501.exe
      4⤵
      PID:14412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49724.exe
    3⤵
    PID:10356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
    3⤵
    PID:14748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50103.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20607.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57996.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
        7⤵
        Executes dropped EXE
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2283.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50838.exe
        9⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51415.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:13640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45238.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:17476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40765.exe
        9⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56187.exe
        9⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30069.exe
        8⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
        9⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28812.exe
        9⤵
        
        PID:18384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57874.exe
        8⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
        8⤵
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53331.exe
        7⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50911.exe
        8⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18639.exe
        9⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23057.exe
        9⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
        8⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
        8⤵
        
        PID:17604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        7⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61539.exe
        7⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57434.exe
        7⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        6⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28708.exe
        7⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        8⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45151.exe
        9⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50517.exe
        9⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25306.exe
        8⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29236.exe
        9⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        9⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46758.exe
        8⤵
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11636.exe
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
        7⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23692.exe
        7⤵
        
        PID:17528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30260.exe
        6⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11798.exe
        7⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42846.exe
        7⤵
        
        PID:17732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53931.exe
        6⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17141.exe
        6⤵
        
        PID:15268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4389.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43575.exe
        6⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        7⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17860.exe
        8⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        8⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8788.exe
        8⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        7⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        7⤵
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57282.exe
        6⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10629.exe
        7⤵
        
        PID:16404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1540.exe
        6⤵
        
        PID:11812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51047.exe
        6⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11795.exe
        6⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39655.exe
        7⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2966.exe
        8⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7164.exe
        8⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26266.exe
        7⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        7⤵
        
        PID:14548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        6⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42391.exe
        7⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63390.exe
        7⤵
        
        PID:14928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7988.exe
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44646.exe
        6⤵
        
        PID:14852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43718.exe
        5⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
        6⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29236.exe
        7⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
        7⤵
        
        PID:17708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        6⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19692.exe
        5⤵
        
        PID:9856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16733.exe
        5⤵
        
        PID:14032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9126.exe
        5⤵
        
        PID:15064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-658.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58588.exe
        6⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29284.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34191.exe
        8⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34783.exe
        9⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28285.exe
        8⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50997.exe
        8⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8653.exe
        7⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
        7⤵
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50517.exe
        7⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        6⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
        7⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        7⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22492.exe
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8596.exe
        6⤵
        
        PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31396.exe
        6⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4206.exe
        7⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
        8⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        7⤵
        
        PID:14660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
        6⤵
        
        PID:9540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        6⤵
        
        PID:14724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
        5⤵
        
        PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        5⤵
        
        PID:10540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29516.exe
        5⤵
        
        PID:17612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57642.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
        5⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        6⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59956.exe
        7⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37522.exe
        7⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58781.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7029.exe
        6⤵
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42530.exe
        6⤵
        
        PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18829.exe
        5⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22549.exe
        6⤵
        
        PID:14592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40749.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33676.exe
        5⤵
        
        PID:15204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
      4⤵
      PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29860.exe
        5⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26023.exe
        6⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4814.exe
        7⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60526.exe
        7⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28285.exe
        6⤵
        
        PID:12820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
        6⤵
        
        PID:17848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32218.exe
        5⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        6⤵
        
        PID:15024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42530.exe
        5⤵
        
        PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
      4⤵
      PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8949.exe
        5⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58102.exe
        5⤵
        
        PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4226.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33799.exe
      4⤵
      PID:13020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36796.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25337.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41655.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34167.exe
        6⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29860.exe
        7⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        8⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
        9⤵
        
        PID:15116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35005.exe
        8⤵
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5581.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        7⤵
        
        PID:14912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42181.exe
        6⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8197.exe
        7⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        7⤵
        
        PID:14944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22406.exe
        6⤵
        
        PID:11956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42722.exe
        6⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        5⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63042.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28660.exe
        7⤵
        
        PID:13812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58781.exe
        7⤵
        
        PID:17432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56910.exe
        6⤵
        
        PID:11828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18637.exe
        5⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe
        5⤵
        
        PID:11480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40706.exe
        5⤵
        
        PID:16372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34551.exe
        5⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37836.exe
        6⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42757.exe
        6⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29479.exe
        7⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
        8⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44645.exe
        7⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46626.exe
        6⤵
        
        PID:10664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe
        6⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2218.exe
        5⤵
        
        PID:7652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50082.exe
        5⤵
        
        PID:10372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51047.exe
        5⤵
        
        PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36314.exe
      4⤵
      PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19479.exe
        5⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
        6⤵
        
        PID:8848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        6⤵
        
        PID:13000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59165.exe
        6⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56037.exe
        5⤵
        
        PID:10700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        5⤵
        
        PID:17288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65238.exe
      4⤵
      PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        5⤵
        
        PID:14020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34678.exe
        5⤵
        
        PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36241.exe
      4⤵
      PID:11020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11342.exe
      4⤵
      PID:16456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42724.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49735.exe
        5⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exe
        6⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38501.exe
        7⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36285.exe
        6⤵
        
        PID:14732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22690.exe
        5⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
        6⤵
        
        PID:8112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8777.exe
        5⤵
        
        PID:11436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64646.exe
        5⤵
        
        PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13341.exe
      4⤵
      PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20247.exe
        5⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1902.exe
        6⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
        6⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34678.exe
        6⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6837.exe
        5⤵
        
        PID:9412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
        5⤵
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50517.exe
        5⤵
        
        PID:14444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
      4⤵
      PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14118.exe
        5⤵
        
        PID:10348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31786.exe
        5⤵
        
        PID:14828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37964.exe
      4⤵
      PID:11612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15050.exe
      4⤵
      PID:17876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17649.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
        5⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3630.exe
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        6⤵
        
        PID:13264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
        6⤵
        
        PID:17896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8949.exe
        5⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63069.exe
        5⤵
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9093.exe
        5⤵
        
        PID:15132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
      4⤵
      PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4814.exe
        5⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25621.exe
        5⤵
        
        PID:15012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
      4⤵
      PID:10532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27916.exe
      4⤵
      PID:15460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48773.exe
    3⤵
    PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
      4⤵
      PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        5⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29236.exe
        6⤵
        
        PID:12684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
        6⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59811.exe
        5⤵
        
        PID:13972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58781.exe
        5⤵
        
        PID:16780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
      4⤵
      PID:10940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9093.exe
      4⤵
      PID:15092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31276.exe
    3⤵
    PID:7332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49988.exe
      4⤵
      PID:12688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19081.exe
    3⤵
    PID:11624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56349.exe
    3⤵
    PID:14844
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30783.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34260.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59548.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4019.exe
        8⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        9⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29236.exe
        10⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
        10⤵
        
        PID:14392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        9⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34660.exe
        9⤵
        
        PID:17224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25285.exe
        8⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        8⤵
        
        PID:14904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13458.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29236.exe
        8⤵
        
        PID:13712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        8⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57874.exe
        7⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42391.exe
        8⤵
        
        PID:14060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38501.exe
        8⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
        7⤵
        
        PID:14544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41602.exe
        6⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44699.exe
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe
        8⤵
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20650.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33260.exe
        7⤵
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51470.exe
        7⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe
        6⤵
        
        PID:11408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15325.exe
        6⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39853.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13611.exe
        6⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45820.exe
        7⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57823.exe
        8⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12774.exe
        9⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22549.exe
        9⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27329.exe
        8⤵
        
        PID:12676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34180.exe
        8⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
        7⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43749.exe
        7⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39846.exe
        7⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4714.exe
        6⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3563.exe
        7⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37261.exe
        7⤵
        
        PID:17748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40002.exe
        6⤵
        
        PID:11192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39962.exe
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4678.exe
        6⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
        7⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11506.exe
        7⤵
        
        PID:14972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52587.exe
        6⤵
        
        PID:10592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23692.exe
        6⤵
        
        PID:17736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25083.exe
        5⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33021.exe
        6⤵
        
        PID:14532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        5⤵
        
        PID:10480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-805.exe
        5⤵
        
        PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29661.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57607.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34660.exe
        6⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30903.exe
        7⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        8⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58102.exe
        8⤵
        
        PID:14476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50558.exe
        7⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62965.exe
        7⤵
        
        PID:14088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-370.exe
        7⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58518.exe
        6⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
        7⤵
        
        PID:10412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22406.exe
        6⤵
        
        PID:11948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33676.exe
        6⤵
        
        PID:15212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39682.exe
        5⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        6⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        7⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41938.exe
        7⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10820.exe
        7⤵
        
        PID:736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10018.exe
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3914.exe
        6⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
        5⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54055.exe
        6⤵
        
        PID:17720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe
        5⤵
        
        PID:11456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe
        5⤵
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36402.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63004.exe
        5⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        6⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
        7⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10854.exe
        8⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe
        8⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10018.exe
        6⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56291.exe
        7⤵
        
        PID:14996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        6⤵
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5674.exe
        5⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59811.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36285.exe
        6⤵
        
        PID:14676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
        5⤵
        
        PID:11044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32238.exe
        5⤵
        
        PID:8108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2077.exe
        5⤵
        
        PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45630.exe
      4⤵
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16791.exe
        5⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57943.exe
        6⤵
        
        PID:12224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        6⤵
        
        PID:18104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        5⤵
        
        PID:12164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        5⤵
        
        PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
      4⤵
      PID:8924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12484.exe
      4⤵
      PID:14780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9786.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49719.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51655.exe
        6⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        7⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
        8⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        8⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42846.exe
        8⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10018.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36069.exe
        7⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        7⤵
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45638.exe
        6⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14694.exe
        7⤵
        
        PID:12108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47677.exe
        6⤵
        
        PID:10496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
        6⤵
        
        PID:15184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16989.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63042.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35050.exe
        7⤵
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56910.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3914.exe
        6⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33545.exe
        5⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47476.exe
        6⤵
        
        PID:9700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42725.exe
        6⤵
        
        PID:15052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48747.exe
        5⤵
        
        PID:11648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        5⤵
        
        PID:14536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8442.exe
      4⤵
      Executes dropped EXE
      PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13331.exe
        5⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        6⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51387.exe
        6⤵
        
        PID:14452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47787.exe
        5⤵
        
        PID:9492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
      4⤵
      PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35919.exe
        5⤵
        
        PID:9204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58102.exe
        5⤵
        
        PID:14460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28467.exe
      4⤵
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3865.exe
      4⤵
      PID:14104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19357.exe
      4⤵
      PID:1312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19084.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61468.exe
        5⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35653.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
        7⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22549.exe
        7⤵
        
        PID:14740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43947.exe
        6⤵
        
        PID:12068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46565.exe
        6⤵
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61974.exe
        5⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45151.exe
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48099.exe
        6⤵
        
        PID:14312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52237.exe
        6⤵
        
        PID:428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54693.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10546.exe
        5⤵
        
        PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16906.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55358.exe
        5⤵
        
        PID:6280
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6280 -s 632
        6⤵
        Program crash
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        6⤵
        
        PID:12500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20245.exe
        6⤵
        
        PID:16876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
        5⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        5⤵
        
        PID:14700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
      4⤵
      PID:7700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36285.exe
        5⤵
        
        PID:15712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe
      4⤵
      PID:10992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18675.exe
      4⤵
      PID:6024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16693.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11987.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1331.exe
        5⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35005.exe
        5⤵
        
        PID:12076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1604.exe
        5⤵
        
        PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30278.exe
      4⤵
      PID:10756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57598.exe
      4⤵
      PID:15160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10740.exe
    3⤵
    PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36303.exe
      4⤵
      PID:7992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37605.exe
      4⤵
      PID:14236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
      4⤵
      PID:14808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
    3⤵
    PID:10032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35818.exe
      4⤵
      PID:15328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
    3⤵
    PID:12060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11737.exe
    3⤵
    PID:16464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45303.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57820.exe
        5⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        6⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
        7⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52012.exe
        8⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53406.exe
        8⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37605.exe
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        7⤵
        
        PID:14636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9826.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45306.exe
        6⤵
        
        PID:13892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        6⤵
        
        PID:14800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe
        5⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45151.exe
        6⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19948.exe
        6⤵
        
        PID:15084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45291.exe
        5⤵
        
        PID:11144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42914.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46315.exe
      4⤵
      PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13907.exe
        5⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10542.exe
        6⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63021.exe
        7⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49235.exe
        6⤵
        
        PID:12408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
        6⤵
        
        PID:17856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48534.exe
        5⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22549.exe
        6⤵
        
        PID:14576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42530.exe
        5⤵
        
        PID:768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30750.exe
      4⤵
      PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe
        5⤵
        
        PID:12460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        5⤵
        
        PID:17468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
      4⤵
      PID:12092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57982.exe
      4⤵
      PID:14436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43907.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43907.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
      4⤵
      PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54556.exe
        5⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16983.exe
        6⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        7⤵
        
        PID:15332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        6⤵
        
        PID:13164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        6⤵
        
        PID:14468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        5⤵
        
        PID:9744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
        5⤵
        
        PID:13592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
      4⤵
      PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3630.exe
        5⤵
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        5⤵
        
        PID:12964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9964.exe
        5⤵
        
        PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22684.exe
      4⤵
      PID:8568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33676.exe
      4⤵
      PID:15320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
    3⤵
    PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2942.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17860.exe
        5⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
        6⤵
        
        PID:15760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        5⤵
        
        PID:13328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        5⤵
        
        PID:644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55851.exe
      4⤵
      PID:8956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59893.exe
      4⤵
      PID:12272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65331.exe
      4⤵
      PID:18376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
    3⤵
    PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
      4⤵
      PID:8600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3781.exe
      4⤵
      PID:12868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
      4⤵
      PID:17596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17388.exe
    3⤵
    PID:9248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36338.exe
    3⤵
    PID:10092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31711.exe
    3⤵
    PID:4552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11593.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11593.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37815.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32932.exe
      4⤵
      PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
        5⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
        6⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33292.exe
        6⤵
        
        PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11636.exe
        5⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56151.exe
        6⤵
        
        PID:15804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
        5⤵
        
        PID:13584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36477.exe
        5⤵
        
        PID:7256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64573.exe
      4⤵
      PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59692.exe
        5⤵
        
        PID:13064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44573.exe
        5⤵
        
        PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
      4⤵
      PID:10012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
      4⤵
      PID:16868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21426.exe
    3⤵
    PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29860.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
        5⤵
        
        PID:8156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        5⤵
        
        PID:14684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
      4⤵
      PID:9752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe
        5⤵
        
        PID:15048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
      4⤵
      PID:13556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25237.exe
      4⤵
      PID:2600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
    3⤵
    PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26812.exe
      4⤵
      PID:9656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33213.exe
        5⤵
        
        PID:15044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31741.exe
      4⤵
      PID:13564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34660.exe
      4⤵
      PID:17268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22489.exe
    3⤵
    PID:10668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57220.exe
      4⤵
      PID:15748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43252.exe
    3⤵
    PID:15356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38306.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38306.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32932.exe
    3⤵
    PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29860.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1523.exe
        5⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58403.exe
        6⤵
        
        PID:14500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28097.exe
        5⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50517.exe
        5⤵
        
        PID:17524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5773.exe
      4⤵
      PID:9112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36970.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43003.exe
      4⤵
      PID:13704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
      4⤵
      PID:14760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49883.exe
    3⤵
    PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4974.exe
      4⤵
      PID:8976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29236.exe
        5⤵
        
        PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38501.exe
        5⤵
        
        PID:14428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14938.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42846.exe
      4⤵
      PID:17852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe
    3⤵
    PID:9408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2162.exe
    3⤵
    PID:14304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10549.exe
    3⤵
    PID:7268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32892.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32892.exe
  2⤵
  PID:5304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57052.exe
    3⤵
    PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17860.exe
      4⤵
      PID:7840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16911.exe
        5⤵
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        5⤵
        
        PID:17888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2524.exe
      4⤵
      PID:11040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65331.exe
      4⤵
      PID:18368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45378.exe
    3⤵
    PID:9704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14350.exe
      4⤵
      PID:14400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
    3⤵
    PID:15376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34804.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34804.exe
  2⤵
  PID:7656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14694.exe
    3⤵
    PID:12128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55030.exe
    3⤵
    PID:14856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10866.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10866.exe
  2⤵
  PID:10916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33006.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33006.exe
  2⤵
  PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4428 -ip 4428
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 6428 -ip 6428
1⤵
PID:9540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5424 -ip 5424
1⤵
PID:9684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6280 -ip 6280
1⤵
PID:10180

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe

Filesize
468KB

MD5
753e776491e54a459c248fadea44b5f4

SHA1
b9f57df54232e21dca1bce19f543517fefeca0ba

SHA256
70a676bd896d56d7c17ac296ca392e34d36568334ce94166f336379d1e603bd9

SHA512
79a250a210809b65836b3e723f163f12f73f2572f13c4aa2c407594d35938a2d1797dc59bde8cf65e767d83fc54b3f2b3e866b890a79ee20e2303bafdbcb9031

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe

Filesize
468KB

MD5
c90b309aa47e8d68e7af02874433b2d3

SHA1
fa7ffe3f262f0c7e918de262194571611be11f51

SHA256
0485cda656bb6898fb4fa6bdbf7b49c95b1fb301cf0a0cb3f879efd1b3dd17ed

SHA512
c0146f05f23c7cd24bb292f4fca6485244544ad5c19068ff97697f2cbf256619d3947c49b33cc04eb520b897d057812b466d524cd31a40a680146e8bc9f66c20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11593.exe

Filesize
468KB

MD5
b6d7438176b9d8da66fa6fdbafbc3961

SHA1
4f4b1657438f1a501144e13eba6ebb09b61a30a9

SHA256
3d4c06b4e0ed0c0d060b934564612e376bc5f9c494d927fbd36f0226bb201aaa

SHA512
a9233acf8504bcaf6d710acb2a4a83a347828f9046d654684c4516ffbd0de8d7ef226eb3f3e0e40dc8dca4da63ecdbbed6b246ae1d3e38c7487f9ae66f8ce531

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14668.exe

Filesize
468KB

MD5
b2282893ab460def5e9be1fb7084f138

SHA1
49af06647c513e53c14d870d836c43ea933a6e1d

SHA256
c24a47f49aa26944e345861e8de9f244281ad571523609564b59977b4316bf0f

SHA512
4a380058283d689a337c597e88cfb810092e23436bdd4e657e7c8740f075212bf6b42b05f05012eb257adf0a37d750160fe232b564484059062c1d793073f49f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15162.exe

Filesize
468KB

MD5
719968cde48a20e4c981f6bd515df89c

SHA1
16872e26d9e3c3f082a2e519dd34b48c740ea4f5

SHA256
b207de10a21a9d3c89c53346cf36cdbfd30a7107541eb243b43756ab0e3fa8c2

SHA512
44deef14ec293882a0d2569d7b6c286c70ab2fe2510e71dab109b09bb29ab3f6dd153fab39b530847444fe703ecff974f5398c6281d25308c8fb9c66fb42a491

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe

Filesize
468KB

MD5
f2e1508f8bac1ea0090551bea15ea1a4

SHA1
77f0548903fefe894de6b19c5d4c89c7eea50590

SHA256
7d18cad2767d9cee8508accb089e06058c3a09a59edd1e5be176e19575383e9a

SHA512
adb701774bea5157f170bdb4b47ec2314fd3b59eb84fbb075bdd099a66f9923b3608af5fbf904ea61db371618f50be30c7131dc835a4f68d0addd6033f8ad102

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19084.exe

Filesize
468KB

MD5
964b47bf01a7f9921915a7671f4b48a1

SHA1
37533bb5ff5d6aebf0e8d6179878ac253415a3f5

SHA256
ddaacdb6edf8976c52fa56519f13c1984f6c4e81dcd70fc63c2e6b978d6eb5c5

SHA512
e187c8f3a17f3252dc2ed5cddb1e4691011dc1685b8a6e0c1d0dcd65ce160963902687fc1e83a010a9a40bbe664108db1aaa51a897014bf9735570dd4a67e05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20258.exe

Filesize
468KB

MD5
9975ef14feb30512f1a353eb96612ddd

SHA1
3a7feaf36701d7161842a95bc004dec79c06973f

SHA256
76eb78c812eb8a5a0912fd810a1d685129d28c899078da7ebb01e0a937de58ed

SHA512
3d0b03f9d329f3f3c48080b74416d44b0fc2c5e82998b1d936b8b80a4a048f4563ecc65e97a323b81df3dda44872800014b7ca62507db2b4a9e07f7b0f881699

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20607.exe

Filesize
468KB

MD5
a1cc1194efb88dd8420653e24d50d22d

SHA1
a5557ba571617eed8bd5ec900ce6e8f9260d0944

SHA256
3cda6e9249d243dae5ed099b971513fb2cd8a1ca86af5fe22b3c1b7584fc4377

SHA512
ef7c6bb35b77804481ec48fec6ce67ac28caf54adcb2d451c5d7bbad89163e825a231f540d8832c7df3b9e63d7a391a5d3082d2e2603a8482c052068997e1cda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe

Filesize
468KB

MD5
4de2e215c4eaa4d69a7d5d0ae129a852

SHA1
b1b353df5543298673fe6c0849075a77ae21cd88

SHA256
9b2034f434adbcd387240da31e1c4811675d2e4dad274ad8ab00701589ae6c14

SHA512
f95a1cac83ff28e26e073edeedb4d1d9d6da4c747697d4f59114c8ce14e7904284cd8a29708448e8ee4a120771c049aaa52508fdb796becb5007b53fb46ccb3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24348.exe

Filesize
468KB

MD5
2126458ab5419610d56efb5000d75f9a

SHA1
1c2cdfea912e3041b9370d73270871866996f469

SHA256
d55454fd5d360d6efc390a30765f476a398c8ae162001b6ee0ff50a9d69032cf

SHA512
d4a02d541a9db436641cd9579ca46382248571283c5ffb88eacc62000f56b02ca424a4247b5e8d3412daa509354d69b8992844be8e5f686e89ef05d7cc19bf5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25337.exe

Filesize
468KB

MD5
23814f5500d70b9d4965c652124e46e2

SHA1
80e5bbc3f2cbc0df553fb5808e312b9cbcca7586

SHA256
4d5d8cc0322fddda6f703f97f36094edba87cd66d290f9a2755ce671de400295

SHA512
359a1efd0d29c71974689944fe99b7c503a9b42a7bcba23adaa19dcaf09d048cbfd1227249b1c15fafe2f959b3465943649e15819606b64cb6aa97a230068441

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe

Filesize
468KB

MD5
55ff3c25a8e2469bfe76059f4c7c45bd

SHA1
25b6f532413e1f9bc20ad16512db4ec88fe679ff

SHA256
42b26f166fa3c9ade85ba8dbbeacfa0f0618b3a33fea13b57be841a2d01dffee

SHA512
d17636e5637fbf0a571d545614407f8070219fe55039cc1e1f34a33727cc6a37c970185e8cbd21fb71599b7955d525857f76ca0f49c3243e0c2450d80fedbc37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe

Filesize
468KB

MD5
020e27deb31f134d65f7565d56bacfc2

SHA1
926cb0b005a1a9feb6a6dc3c0dc3c61931c19815

SHA256
33e92bf72938027cc6ea89cdf6cbeff97a00827b002b4db607f1b34aa8ef2db4

SHA512
39313c7b17f4a65a484a66640ef2e7379fb7f3ebc477faf3161996354a80031710c7c54d3e7d37158554f398c1976c6912daabf472a9ffcee8bdbf667279f28e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29661.exe

Filesize
468KB

MD5
4675099493c3bd7b21a15df9792d2aef

SHA1
116e385dd4499558d498b185cce039739b5cc374

SHA256
25157268ce0d986d445b65521f09e8549ee2deb41c5697d34afde5bad561fb1b

SHA512
669c4189c392aac71dbf732b1dfbbc8a9b9ea4c9138fe405e86ca5bd92ee7a833c4fe368668cb625a9f0b6c0c70c4722942d0a099a81cbdc8c3044768ddc7342

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30783.exe

Filesize
468KB

MD5
73d6787aa4796857c9194c8e338411c4

SHA1
c7e1b59b3c27c7dc0a01cca47ca8c0dd5831041c

SHA256
3680ce79902f5d1322badf5560c70544ca80e99b43aa984b0eb51e153a860199

SHA512
fde71763054509997a5e1d741f95595d74c036d1f79d535bedf864c21ad4beab4a00d6eb1867c7612e2fb3f47cdad7dcbf5f4865ed110a98b1f853be7dd546d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe

Filesize
468KB

MD5
b8750263563b7564b77a2ea888580256

SHA1
cdcc2a46ae722693e95d4de512627962addb89a9

SHA256
17cf4016bd399aba0562ca017cd626eac91b022ad278c20894805fc31736515f

SHA512
634acd8f1ca7ab2466ef987dc2fa6b0794fb9270b9aaf80601b39b763ef02bd67a71ae06f7517f45342037e5e6cc40426b39cb732242e9d31537cd69ad61543c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32319.exe

Filesize
468KB

MD5
e062f5f51451df8ffda006e4afe66e25

SHA1
3099990963d7f5c9c6b718c1b356d1a1b6807f4f

SHA256
06a58b92cd2e5cc116e3da1135421d94e04868b44a9731779b24f37f130b7c5d

SHA512
06de833f3b7553550891564bc606297219b64b37859748421a0f8d014e736fd231a110dc054f8d125b80fb67683c95a82e2bc16f37661597ab3fdd8da95bf1de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34260.exe

Filesize
468KB

MD5
d58811ba5566f584df2790a3b750be49

SHA1
d206dd90bde0b8b58848bc763343ec9969ff210f

SHA256
a4d72a512bc7edab127741b02d38c4c3b732f674dd89a10a4f035847eb1c7f39

SHA512
1f23caa6d415a3414fe8932265fe7ffa88c43edff957154bfc9e39ca013ae5d26a87ba2d7ae4e8a89ca2f44796848cd1ca17f03bb24665ffcc32971c921e2d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36069.exe

Filesize
468KB

MD5
83eec565c7128809ad57c0d075b62c7f

SHA1
4b6030480cc63d4222422f1ace54b94fded3e8ef

SHA256
ff769feadecaeecd037f7d0d77f398057e16652d25f6f552e32583e3315b085d

SHA512
d1e359a1750a96e84e3023db86a360d7cc03afca220196f24a366fe2f04a2876d3a96c9c154020851e3e1cb700f20df2ca00c8f6a27f7bc8f411fdb3244d5fc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe

Filesize
468KB

MD5
eb10c94db6b3158518b07bcd6941965b

SHA1
ca6adadfcde4daf066ee3721ae29f9b9b945c849

SHA256
703d2d630e69a8f1619d2ac978b5caf45284b2e5ffa7bcb071975dc56e9c1e7b

SHA512
7df4b68332fcff05ea3dff9636c808f79ad79d7a5e2337ae8948305fbc0c812fb64ee157b2e8ce391460a0ca5810c274adfe2b50df835536abead084e810035a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45303.exe

Filesize
468KB

MD5
c879759945682cd86304b83e389d096f

SHA1
dab20c701aad8ba3ac7daa3264477868b3c6e56c

SHA256
77b3eab984270d114157296de432d0baae338a486fb2d4f4eb982814166396d3

SHA512
a5ba92b51b489c34ba44a8e87dde2536ab0ee722c4cb6baa8c74b50c0159b9363c53d7eee30f9947469a406348c5b797b07ec5486f5c025e86840174f6030e44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45820.exe

Filesize
468KB

MD5
f469f824b1cd3fb0a965e02fecacd053

SHA1
93c13cbd2bac835fa9cd019b9b6baf48ac7fc3c6

SHA256
6c58b7d15bd7aff094ea400c65592d3bd87e3d64e6db3f2659124fdf193a4295

SHA512
392b7146227758fe0bd9f461f73b0aa379d43008b4340f7e6ca3bfda09b7fba65a1fc343eb2346c58491603dca538e0bee4f01a53911826bc88c00d9ec4b836f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49719.exe

Filesize
468KB

MD5
901b21e8acd61dcd70621dcbf582f847

SHA1
9d91f6069e83aea0c3165396a2c32720f81e87e9

SHA256
0037df029544eb7bff675d9993362361199e5cc7df0786ae9991f5234db24099

SHA512
2d267b467fb83bfede11ac1a77948a5fe2a7db6550c926732b06ec9258eafc19af8b265cc617674a8f2beeb933641805ff289cef1918183e2d43c593cbf59896

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50103.exe

Filesize
468KB

MD5
bc0671855e19577b3ad76370f81d3fac

SHA1
8c9ce0aaccef0a2eafeb5443f1189e3794f4b35f

SHA256
ecd6d8a77e4f8936a8990ddb06998b8fe4a6da8688ffc5e69377e348cec1f953

SHA512
a4a9eecd23fe6d38278c80af5a37e9f856e88b52f9cf514055f79ecec976ea94febdb1cf4894332521451bd13a73f0f2c076e45f09618afe2410864fa002efc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe

Filesize
468KB

MD5
b28316f02bf6d2acaa352f636e09d0fa

SHA1
1d62621e0546c35fbff312cf1807a7eabd85bc7a

SHA256
9ba8b4556022f6b3d61edda313c35da3900fb56d10b9a94a2badfc88feafffa2

SHA512
2d10414d20ae354e862533750ca89411135fd0aed3b87360fda3ab5f25f4591c49628cf9ac0bdab7f9966dbca23e4a993d8ed72a759309e77efd4f61f3ecf7ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe

Filesize
468KB

MD5
39517056416e379d8ffef51709b4f745

SHA1
4b223e6cd9da95c1115354bbf4197b47fd056193

SHA256
7534312572e479e0012b3210b801fc0e863b971461675f58b35309fd7605181c

SHA512
b1638f02024adf4f26c177634fc546e572c34176030a4ea1d0ecbd667693dcb3b515e9925c3bf0420a537afee986b9dee8e6d74272b6af385cf3aa660bb6ef72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57996.exe

Filesize
468KB

MD5
af38e5d263deca33b6c6783c7a93d089

SHA1
431f2496e18c48d27c3b3a1818c842cc9e608b9e

SHA256
685a28917627890d469e7e5981a40f56c29e2768f7c47a9714bcb344bd944b6d

SHA512
671b2cb4984a8739fff700d111263c59fc3391899d84263d8098b623eb3c2198d5e9f7381108ea26d0c4465b59cf2c99994251ca128268d330c5cc829dd8bbb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe

Filesize
468KB

MD5
fa2bc4d978c2b9c6ced7833ef04e99ba

SHA1
56c6d14cb6c68e60f190d674ffe7cab72f76b902

SHA256
cde40ef7fad544145448a2118ef2754bc69fc7489d70432ae5b845868d9a6d49

SHA512
c5df77e8ff5ca6c23bf7b704499a503bcd72468034f3243ed1e1a21ee5e6df4bf81e8f40b0f0811cc5d6271298180658af691d872e540144f39b234187b9ffe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63382.exe

Filesize
468KB

MD5
73452f136e87062e1ea96dd18902cdfa

SHA1
5e33938f12a2bdc137bc72c4c6f68e39bb85c63e

SHA256
1348cbea587281266425aba10dfcdd4371d31be5a1a01c89e909d8435124bcd0

SHA512
cb5bb43e543f952bb715a919d8e0e85ce14111efe3d0606495c6630897c5ac2423acb91136aaf0fea1c512679a761804415962f03964a4117370ebfd4b0287ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-658.exe

Filesize
468KB

MD5
a8229ecf883f1b4011978724c13b470f

SHA1
94b1723c7cee0515832359a936d0e7dcdfb39896

SHA256
94371ade059d5e5bc344c15c4c2a44113a622a76c7f2142b6b06968ea66144b7

SHA512
4cfe287efcb1564bdf50f064333541469df1d1cd6d70317a9cc738609061f06ede26e90b0a6f141af0620a3aa80a178a474603c63a46b571ab0cb537690a2985

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9786.exe

Filesize
468KB

MD5
ce3e50bf8fb19632acb4c65c2c91be3f

SHA1
0216802e97b2a213e22ab74cc5bbc673ffc5da46

SHA256
b342009828a23d5b5dd6c4e24737f9b3368fb71540cee9bff7ab27a0a40372d1

SHA512
b68e3134b89fde5c6b504eda2a6bb8d214d9e057545b84af692c0cfe303e3628da4c5475b3123ba7dfc5c94fb6c7e9842e0d12b1de37bf523da2b85023be00b3

Download Submit
memory/220-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/224-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/404-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/440-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/536-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/684-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/732-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/876-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/944-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1088-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1184-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1328-153-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1360-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1432-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1464-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1556-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1560-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1612-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1624-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1664-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1792-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1948-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1956-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2032-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2236-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2372-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2388-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2444-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2448-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2496-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2516-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2568-108-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2624-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2660-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3036-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3096-16-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3116-155-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3148-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3332-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3456-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3480-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3496-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3564-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3568-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3644-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3728-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3772-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3844-152-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3916-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3968-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4092-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4136-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4320-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4344-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4372-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4428-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4428-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4464-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4608-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4616-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4636-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4668-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4792-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4848-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4924-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4928-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4968-115-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5048-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5056-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5220-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5232-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5244-483-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5256-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5268-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5288-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5296-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5304-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5336-556-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5356-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5364-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5376-557-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5388-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5404-564-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5424-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5436-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5448-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5468-555-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5556-589-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5588-590-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5656-2387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5912-591-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13320-2375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13892-2350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14028-2388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14048-2345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14188-2347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14312-2349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads